@go-to-k/cdkd 0.291.24 → 0.291.26

package/dist/{program-CQ_Y14q1.js → program-BALgPCWL.js}

@@ -1,8 +1,8 @@
-import { $ as yellow, $i as synthesisStatusMessage, $n as refuseMalformedOrphanRecordsForDestroy, $r as forceQuitRecoveryClause, $t as configIntegerRefusal, A as createPreDeleteFinalSnapshot, Aa as credentialFingerprint, Ai as validateContainerRepoName, An as hasReadableOutputs, Ao as retryClassificationText, Ar as TEMPLATE_SOURCED_RULES, At as deleteSkipReason, B as isStatefulRecreateTargetSync, Ba as absoluteAssemblyPathEscape, Bi as getDockerCmd, Bn as malformedOrphansRefusalMessage, Br as maskSecretsInText, Bt as isImpossibleEmptyStoredAttribute, C as namesAnyDeclaredParameter, Ca as expectedOwnerParam, Ci as assertAssetBucketRegion, Cn as STATE_REGION_DIVERGED, Co as shellQuote, Cr as describeTypeWithThrottleRetry, Ct as compositeIdSkipResult, D as PRE_DELETE_SNAPSHOT_TYPES, Da as ambientClientDefaults, Di as parseBootstrapMarker, Dn as deployRefusesOrphanRowsReason, Do as isTransientServerError, Dr as STATE_SOURCED_BASELINE_RULES, Dt as maskerOrIdentity, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as derivePartitionAndUrlSuffix, Ei as isCrossRegionRedirect, En as UNREADABLE_RESOURCES_MAP_ROW, Eo as isThrottlingError, Er as TemplateParser, Et as maskDeep, F as extractDeploymentEventError, Fa as defineOwnKey, Fi as describeDockerExecFailure, Fn as malformedExportSourceWarning, Fr as identityKeyFor, Ft as carriesDynamicReference, G as toCfnInteger, Ga as resolveBucketRegion, Gi as runDockerForeground, Gn as malformedResourceEntriesWarning, Gr as redactSecretsForState, Gt as isSettledInstanceState, H as WARM_THROUGHPUT_MEMBERS, Ha as renderAssemblyPathEscape, Hi as isMalformedEnvKey, Hn as malformedOutputsRefusalMessage, Hr as recordMaskOnlyValue, Ht as isUnboundTemplateParameter, I as makeSiblingClaimReader, Ia as hasOwnKey, Ii as describeDockerFailure, In as malformedLocalOutputsWarning, Ir as isSingleDynamicReferenceToken, It as carriesFetchableDynamicReference, J as bold, Ja as resetAwsClients, Ji as escapeRegExp, Jn as malformedStateRefusalMessage, Jr as S3StateBackend, Jt as resolveExplicitPhysicalId, K as toFiniteNumber, Ka as AwsClients, Ki as runDockerStreaming, Kn as malformedResourcePropertiesWarning, Kr as scrubResourceRecord, Kt as WAFv2WebACLProvider, L as planOrphanAdoption, La as hasPlainPrototype, Li as dockerSpawnEnvWithSensitive, Ln as malformedOrphanRecordsRefusalMessage, Lr as isUncertifiedBaselineMaskPosition, Lt as cfnRefValueFromPhysicalId, M as refusesFinalSnapshot, Ma as failedStageNote, Mi as buildDockerImage, Mn as isReadableOrphanRecord, Mo as safeStringify, Mr as createSecretMasker, Mt as disableInstanceApiTermination, N as unsupportedFinalSnapshotError, Na as globMatches, Ni as resolveDockerContextDirectory, Nn as isReadableResourceEntry, Nr as dynamicReferenceTokens, Nt as isTerminationProtectionPropagationError, O as buildFinalSnapshotIdentifier, Oa as ambientCredentialConfig, Oi as readBootstrapMarkerBody, On as displayLogicalId, Oo as markNonRetryable, Or as STATE_SOURCED_CROSS_GENERATION_RULES, Ot as UNSPECIFIED_SKIP_REASON, P as makeCanonicalizePropertiesFn, Pa as processStackMessages, Pi as describeDockerCapturedOutput, Pn as malformedExportNamesWarning, Pr as errorCauseChain, Pt as IntrinsicFunctionResolver, Q as red, Qa as CdkdError, Qi as Synthesizer, Qn as refuseMalformedOrphanRecords, Qr as buildLockContentionMessage, Qt as configBooleanRefusal, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as nullPrototypeRecord, Ri as finchSecretArgvRefusal, Rn as malformedOrphanRecordsWarning, Rr as markSameGenerationBag, Rt as coerceParameterTypedValue, S as computeParameterTaint, Sa as decodeListingKey, Si as BOOTSTRAP_MARKER_PREFIX, Sn as INTRINSIC_KEYS, So as pasteableCommand, Sr as findSilentDropProperties, St as compositeIdSeparatorRefusal, T as resourcesNamingDeclaredParameter, Ta as canonicalizeRegion, Ti as getBootstrapMarkerKey, Tn as UNREADABLE_ORPHANS_CONTAINER_ROW, To as isRetryableTransientError, Tr as DagBuilder, Tt as createMaskedRetryLogger, U as coerceWarmThroughput$1, Ua as resolveAssemblyPath, Ui as partitionSensitiveEnv, Un as malformedOutputsWarning, Ur as recordMaskOnlyValuesIn, Ut as parameterTypeMayLoseSecretIdentity, V as renderStatefulReason, Va as displayAssemblyPath, Vi as isDockerClientEnvKey, Vn as malformedOrphansWarning, Vr as pathCrossesDottedKey, Vt as isNamelessDynamicReferenceError, W as isWarmThroughputDecrease, Wi as redactDockerArgvValues, Wn as malformedRenderedContainersWarning, Wr as recoverMaskedOutput, Wt as refStateLookupFromResource, X as gray, Xa as setAwsClients, Xi as AssetManifestLoader, Xn as refuseDivergentRecordRegionForDestroy, Xr as UNREPRODUCIBLE_LOCK_CLAUSE, Xt as coerceCfnBoolean, Y as cyan, Ya as runWithStackAwsClients, Yi as stripControlChars, Yn as previewableOrphanRecords, Yr as rebuildClientForBucketRegion, Yt as assertRegionMatch, Z as green, Zi as getDockerImageBySourceHash, Zn as refuseMalformedNestedChildOutputs, Zr as buildForceUnlockCommand, Zt as coerceCfnInteger, _ as bagHoldsSecretExpression, _a as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, _i as buildAssetRedirectMap, _n as AWS_CREDENTIAL_ENV_KEYS, _o as SynthesisError, _r as safeRegion, _t as startInterruptWatch, a as DeploymentEventsStore, aa as resolveSkipPrefix, ai as hasReadableExportSet, an as requireConfigString, ao as LocalInvokeBuildError$1, ar as refuseMalformedResourceAttributesForOrphan, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as producerCoordinateKey, bi as rewriteTemplateAssetReferences, bn as envCredentialsAreAssumedRole, bo as normalizeAwsError, br as unreadableOrphanRecords, bt as ccProtectionRegistryTypes, c as replayFailedOperations, ca as resolveUseCdkBootstrapAssets, ci as importableOutputKeys, cn as classifyReplaySecretRegion, co as MalformedProducerRecordRefusalError, cr as refuseMalformedResourcePropertiesForOrphan, ct as IAMRoleProvider, d as updatePartialMessage, da as ssmResolvedValueType, di as orphansAfterRollback, dn as s3BucketArn, do as ProvisioningError, dr as repairMalformedOrphanRecordsForReadOnly, dt as ProviderRegistry, ea as getDefaultStateBucketName, ei as formatLockExpiry, en as configStringRefusal, eo as CrossAccountSecretRefusalError, er as refuseMalformedOrphans, et as collectDeclaredOutputNames, f as updatePartialReason, fa as CFN_TEMPLATE_BODY_LIMIT, fi as orphansCarriedFrom, fn as s3BucketDomainName, fo as ResourceTimeoutError, fr as repairMalformedOrphansForReadOnly, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as uploadCfnTemplate, gi as WorkGraph, gn as applyRoleArnIfSet, gr as repairMalformedResourcesForReadOnly, gt as isInterruptedWaitError, h as IMPLICIT_DELETE_DEPENDENCIES, ha as findLargeInlineResources, hi as stringifyValue, hn as s3BucketWebsiteUrl, ho as StackTerminationProtectionError, hr as repairMalformedResourcePropertiesForReadOnly, ht as interruptWatchListenerCount, i as DeploymentEventsReader, ia as resolveCaptureObservedState, ii as exportNamesCarriedFrom, in as requireConfigObject, io as IntrinsicResolutionRefusalError, ir as refuseMalformedOutputsForDestroy, it as secretBearing, j as isFinalSnapshotError, ja as AssemblyReader, ji as buildDenyExternalAccessPolicy, jn as hasReadableResources, jo as describeAwsFailure, jr as carriesSecretMask, jt as isWaitAbandonedError, k as ccRoutedFinalSnapshotError, ka as clientDefaultsFor, ki as validateAssetBucketName, kn as hasReadableOrphans, ko as markRedactedCause, kr as STATE_SOURCED_READBACK_RULES, kt as deleteIndeterminateGuards, l as replayRollback, la as stateBucketExistenceConfirmed, li as importableOutputs, ln as producerRegionsFromState, lo as NestedStackChildDirectDestroyError, lr as refuseMalformedResourcesForDestroy, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as MIGRATE_TMP_PREFIX, mi as AssetPublisher, mn as s3BucketRegionalDomainName, mo as StackHasActiveImportsError, mr as repairMalformedResourceEntriesForReadOnly, mt as endCommandInterruptScope, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as resolveApp, ni as DEFAULT_STATE_PREFIX, nn as replayWarn, no as DeployCancelledError, nr as refuseMalformedOrphansForOrphan, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as resolveStateBucketWithDefault, oi as hasReasonlessBaselineRefusal, on as definedAttributes, oo as LocalStartServiceError, or as refuseMalformedResourceEntries, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as CFN_TEMPLATE_URL_LIMIT, pi as shouldRetainResource, pn as s3BucketDualStackDomainName, po as ResourceUpdateNotSupportedError, pr as repairMalformedOutputsForReadOnly, pt as beginCommandInterruptScope, q as formatResourceLine, qa as getAwsClients, qi as warnFinchArgvExposure, qn as malformedResourcesWarning, qr as LockManager, qt as normalizeAwsTagsToCfn, r as DeployEngine, ra as resolveAutoAssetStorage, ri as describeRegionValueKind, rn as requireConfigArray, ro as DynamicReferenceRegionAmbiguousError, rr as refuseMalformedOutputs, rt as isExportAliasCollision, s as planRollback, sa as resolveStateBucketWithDefaultAndSource, si as hasUnverifiableParameterRefusal, sn as stringifyIfAssigned, sr as refuseMalformedResourceEntriesForOrphan, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as getLegacyStateBucketName, ti as CUSTOM_RESOURCE_RESPONSE_PREFIX, tn as readConfigString, tr as refuseMalformedOrphansForDestroy, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as warnDeprecatedNoPrefixCliFlag, ui as isReadableBag, un as withSharedDrainBudget, uo as PartialFailureError, ur as refuseMalformedState, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as injectiveKey, vi as createAssetRedirectResolver, vn as applyCallerIdentityCredentials, vr as safeStackName, vt as CloudControlProvider, w as reachableDivergentParameters, wa as PARTITION_TABLE, wi as ensureAssetStorage, wn as STATE_RESOURCES_MALFORMED, wo as isMarkedNonRetryable, wr as withRetry, wt as packCompositeId, x as bindingSkippedOutputs, xa as producerRecordKey, xi as AssetModeResolver, xn as DiffCalculator, xo as withErrorHandling, xr as findActionableSilentDrops, xt as compositeIdFormatMessage, y as keptWholeReasonText, ya as injectiveKeyPrefix, yi as loadPublishableAssetManifest, yn as callerEnvCredentials, yr as unpreviewableOrphanRecords, yt as slowCcOperationTimeoutMs, z as isStatefulRecreateTargetForReplace, za as ownValue, zi as formatDockerLoginError, zn as malformedOrphanRowsKeptWarning, zr as maskSecretsInError, zt as getAccountInfo } from "./deploy-engine-Czuf7jgT.js";
+import { $ as yellow, $a as CdkdError, $i as synthesisStatusMessage, $n as refuseMalformedOrphanRecordsForDestroy, $r as forceQuitRecoveryClause, $t as configIntegerRefusal, A as createPreDeleteFinalSnapshot, Aa as credentialFingerprint, Ai as validateContainerRepoName, An as hasReadableOutputs, Ao as markRedactedCause, Ar as TEMPLATE_SOURCED_RULES, At as deleteSkipReason, B as isStatefulRecreateTargetSync, Ba as absoluteAssemblyPathEscape, Bi as getDockerCmd, Bn as malformedOrphansRefusalMessage, Br as maskSecretsInText, Bt as isImpossibleEmptyStoredAttribute, C as namesAnyDeclaredParameter, Ca as expectedOwnerParam, Ci as assertAssetBucketRegion, Cn as STATE_REGION_DIVERGED, Co as pasteableCommand, Cr as describeTypeWithThrottleRetry, Ct as compositeIdSkipResult, D as PRE_DELETE_SNAPSHOT_TYPES, Da as ambientClientDefaults, Di as parseBootstrapMarker, Dn as deployRefusesOrphanRowsReason, Do as isThrottlingError, Dr as STATE_SOURCED_BASELINE_RULES, Dt as maskerOrIdentity, E as ATOMIC_FINAL_SNAPSHOT_TYPES, Ea as derivePartitionAndUrlSuffix, Ei as isCrossRegionRedirect, En as UNREADABLE_RESOURCES_MAP_ROW, Eo as isRetryableTransientError, Er as TemplateParser, Et as maskDeep, F as extractDeploymentEventError, Fa as defineOwnKey, Fi as describeDockerExecFailure, Fn as malformedExportSourceWarning, Fr as identityKeyFor, Ft as carriesDynamicReference, G as toCfnInteger, Gi as runDockerForeground, Gn as malformedResourceEntriesWarning, Gr as redactSecretsForState, Gt as isSettledInstanceState, H as WARM_THROUGHPUT_MEMBERS, Ha as displayAssemblyPath, Hi as isMalformedEnvKey, Hn as malformedOutputsRefusalMessage, Hr as recordMaskOnlyValue, Ht as isUnboundTemplateParameter, I as makeSiblingClaimReader, Ia as hasOwnKey, Ii as describeDockerFailure, In as malformedLocalOutputsWarning, Ir as isSingleDynamicReferenceToken, It as carriesFetchableDynamicReference, J as bold, Ja as getAwsClients, Ji as escapeRegExp, Jn as malformedStateRefusalMessage, Jr as S3StateBackend, Jt as resolveExplicitPhysicalId, K as toFiniteNumber, Ka as resolveBucketRegion, Ki as runDockerStreaming, Kn as malformedResourcePropertiesWarning, Kr as scrubResourceRecord, Kt as WAFv2WebACLProvider, L as planOrphanAdoption, La as hasPlainPrototype, Li as dockerSpawnEnvWithSensitive, Ln as malformedOrphanRecordsRefusalMessage, Lr as isUncertifiedBaselineMaskPosition, Lt as cfnRefValueFromPhysicalId, M as refusesFinalSnapshot, Ma as failedStageNote, Mi as buildDockerImage, Mn as isReadableOrphanRecord, Mo as describeAwsFailure, Mr as createSecretMasker, Mt as disableInstanceApiTermination, N as unsupportedFinalSnapshotError, Na as globMatches, Ni as resolveDockerContextDirectory, Nn as isReadableResourceEntry, No as safeStringify, Nr as dynamicReferenceTokens, Nt as isTerminationProtectionPropagationError, O as buildFinalSnapshotIdentifier, Oa as ambientCredentialConfig, Oi as readBootstrapMarkerBody, On as displayLogicalId, Oo as isTransientServerError, Or as STATE_SOURCED_CROSS_GENERATION_RULES, Ot as UNSPECIFIED_SKIP_REASON, P as makeCanonicalizePropertiesFn, Pa as processStackMessages, Pi as describeDockerCapturedOutput, Pn as malformedExportNamesWarning, Pr as errorCauseChain, Pt as IntrinsicFunctionResolver, Q as red, Qi as Synthesizer, Qn as refuseMalformedOrphanRecords, Qr as buildLockContentionMessage, Qt as configBooleanRefusal, R as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ra as nullPrototypeRecord, Ri as finchSecretArgvRefusal, Rn as malformedOrphanRecordsWarning, Rr as markSameGenerationBag, Rt as coerceParameterTypedValue, S as computeParameterTaint, Sa as decodeListingKey, Si as BOOTSTRAP_MARKER_PREFIX, Sn as INTRINSIC_KEYS, So as withErrorHandling, Sr as findSilentDropProperties, St as compositeIdSeparatorRefusal, T as resourcesNamingDeclaredParameter, Ta as canonicalizeRegion, Ti as getBootstrapMarkerKey, Tn as UNREADABLE_ORPHANS_CONTAINER_ROW, To as isMarkedNonRetryable, Tr as DagBuilder, Tt as createMaskedRetryLogger, U as coerceWarmThroughput$1, Ua as renderAssemblyPathEscape, Ui as partitionSensitiveEnv, Un as malformedOutputsWarning, Ur as recordMaskOnlyValuesIn, Ut as parameterTypeMayLoseSecretIdentity, V as renderStatefulReason, Va as describeFileReadFailure, Vi as isDockerClientEnvKey, Vn as malformedOrphansWarning, Vr as pathCrossesDottedKey, Vt as isNamelessDynamicReferenceError, W as isWarmThroughputDecrease, Wa as resolveAssemblyPath, Wi as redactDockerArgvValues, Wn as malformedRenderedContainersWarning, Wr as recoverMaskedOutput, Wt as refStateLookupFromResource, X as gray, Xa as runWithStackAwsClients, Xi as AssetManifestLoader, Xn as refuseDivergentRecordRegionForDestroy, Xr as UNREPRODUCIBLE_LOCK_CLAUSE, Xt as coerceCfnBoolean, Y as cyan, Ya as resetAwsClients, Yi as stripControlChars, Yn as previewableOrphanRecords, Yr as rebuildClientForBucketRegion, Yt as assertRegionMatch, Z as green, Za as setAwsClients, Zi as getDockerImageBySourceHash, Zn as refuseMalformedNestedChildOutputs, Zr as buildForceUnlockCommand, Zt as coerceCfnInteger, _ as bagHoldsSecretExpression, _a as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, _i as buildAssetRedirectMap, _n as AWS_CREDENTIAL_ENV_KEYS, _r as safeRegion, _t as startInterruptWatch, a as DeploymentEventsStore, aa as resolveSkipPrefix, ai as hasReadableExportSet, an as requireConfigString, ao as IntrinsicResolutionRefusalError, ar as refuseMalformedResourceAttributesForOrphan, at as secretBearingStateKeyWarning, b as mergeNoChangeOutputs, ba as producerCoordinateKey, bi as rewriteTemplateAssetReferences, bn as envCredentialsAreAssumedRole, br as unreadableOrphanRecords, bt as ccProtectionRegistryTypes, c as replayFailedOperations, ca as resolveUseCdkBootstrapAssets, ci as importableOutputKeys, cn as classifyReplaySecretRegion, cr as refuseMalformedResourcePropertiesForOrphan, ct as IAMRoleProvider, d as updatePartialMessage, da as ssmResolvedValueType, di as orphansAfterRollback, dn as s3BucketArn, do as PartialFailureError, dr as repairMalformedOrphanRecordsForReadOnly, dt as ProviderRegistry, ea as getDefaultStateBucketName, ei as formatLockExpiry, en as configStringRefusal, er as refuseMalformedOrphans, et as collectDeclaredOutputNames, f as updatePartialReason, fa as CFN_TEMPLATE_BODY_LIMIT, fi as orphansCarriedFrom, fn as s3BucketDomainName, fo as ProvisioningError, fr as repairMalformedOrphansForReadOnly, ft as wouldReturnToSdkProvider, g as computeImplicitDeleteEdges, ga as uploadCfnTemplate, gi as WorkGraph, gn as applyRoleArnIfSet, go as StackTerminationProtectionError, gr as repairMalformedResourcesForReadOnly, gt as isInterruptedWaitError, h as IMPLICIT_DELETE_DEPENDENCIES, ha as findLargeInlineResources, hi as stringifyValue, hn as s3BucketWebsiteUrl, ho as StackHasActiveImportsError, hr as repairMalformedResourcePropertiesForReadOnly, ht as interruptWatchListenerCount, i as DeploymentEventsReader, ia as resolveCaptureObservedState, ii as exportNamesCarriedFrom, in as requireConfigObject, io as DynamicReferenceRegionAmbiguousError, ir as refuseMalformedOutputsForDestroy, it as secretBearing, j as isFinalSnapshotError, ja as AssemblyReader, ji as buildDenyExternalAccessPolicy, jn as hasReadableResources, jo as retryClassificationText, jr as carriesSecretMask, jt as isWaitAbandonedError, k as ccRoutedFinalSnapshotError, ka as clientDefaultsFor, ki as validateAssetBucketName, kn as hasReadableOrphans, ko as markNonRetryable, kr as STATE_SOURCED_READBACK_RULES, kt as deleteIndeterminateGuards, l as replayRollback, la as stateBucketExistenceConfirmed, li as importableOutputs, ln as producerRegionsFromState, lo as MalformedProducerRecordRefusalError, lr as refuseMalformedResourcesForDestroy, lt as collectInlinePolicyNamesManagedBySiblings, m as maskingRetryLogger, ma as MIGRATE_TMP_PREFIX, mi as AssetPublisher, mn as s3BucketRegionalDomainName, mo as ResourceUpdateNotSupportedError, mr as repairMalformedResourceEntriesForReadOnly, mt as endCommandInterruptScope, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as resolveApp, ni as DEFAULT_STATE_PREFIX, nn as replayWarn, nr as refuseMalformedOrphansForOrphan, nt as exportAliasCollisionScrubWarning, o as planFailedOps, oa as resolveStateBucketWithDefault, oi as hasReasonlessBaselineRefusal, on as definedAttributes, oo as LocalInvokeBuildError$1, or as refuseMalformedResourceEntries, ot as secretSafeKeyDisplay, p as withResourceDeadline, pa as CFN_TEMPLATE_URL_LIMIT, pi as shouldRetainResource, pn as s3BucketDualStackDomainName, po as ResourceTimeoutError, pr as repairMalformedOutputsForReadOnly, pt as beginCommandInterruptScope, q as formatResourceLine, qa as AwsClients, qi as warnFinchArgvExposure, qn as malformedResourcesWarning, qr as LockManager, qt as normalizeAwsTagsToCfn, r as DeployEngine, ra as resolveAutoAssetStorage, ri as describeRegionValueKind, rn as requireConfigArray, ro as DeployCancelledError, rr as refuseMalformedOutputs, rt as isExportAliasCollision, s as planRollback, sa as resolveStateBucketWithDefaultAndSource, si as hasUnverifiableParameterRefusal, sn as stringifyIfAssigned, so as LocalStartServiceError, sr as refuseMalformedResourceEntriesForOrphan, st as getCurrentResourceSecrets, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as getLegacyStateBucketName, ti as CUSTOM_RESOURCE_RESPONSE_PREFIX, tn as readConfigString, to as CrossAccountSecretRefusalError, tr as refuseMalformedOrphansForDestroy, tt as collectPublishedOutputNames, u as resolveReplacementOldType, ua as warnDeprecatedNoPrefixCliFlag, ui as isReadableBag, un as withSharedDrainBudget, uo as NestedStackChildDirectDestroyError, ur as refuseMalformedState, ut as clearOnUpdateRemoval, v as isSecretBearingReferenceString, va as injectiveKey, vi as createAssetRedirectResolver, vn as applyCallerIdentityCredentials, vo as SynthesisError, vr as safeStackName, vt as CloudControlProvider, w as reachableDivergentParameters, wa as PARTITION_TABLE, wi as ensureAssetStorage, wn as STATE_RESOURCES_MALFORMED, wo as shellQuote, wr as withRetry, wt as packCompositeId, x as bindingSkippedOutputs, xa as producerRecordKey, xi as AssetModeResolver, xn as DiffCalculator, xo as normalizeAwsError, xr as findActionableSilentDrops, xt as compositeIdFormatMessage, y as keptWholeReasonText, ya as injectiveKeyPrefix, yi as loadPublishableAssetManifest, yn as callerEnvCredentials, yr as unpreviewableOrphanRecords, yt as slowCcOperationTimeoutMs, z as isStatefulRecreateTargetForReplace, za as ownValue, zi as formatDockerLoginError, zn as malformedOrphanRowsKeptWarning, zr as maskSecretsInError, zt as getAccountInfo } from "./deploy-engine-BZps_IKn.js";
 import { C as displayAwsMessage, D as isPasteableIdent, E as displayStackName, O as truncateCodePoints, S as UNRENDERABLE, T as displaySafe, _ as withSkipPrefix, b as SECRET_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as displayIdent, x as STACK_REF_MAX_CODE_POINTS } from "./logger-Bt0RGDfb.js";
 import { n as awsClientDefaults, s as ambientRegion } from "./aws-client-defaults-jISU4PHo.js";
-import { t as getCdkdVersion } from "./version-BI33Emlj.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CXNAEgyw.js";
+import { t as getCdkdVersion } from "./version-BkoR4hMq.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-Dbqbr89e.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -3073,7 +3073,7 @@ function validateRecreateTargets(input) {
 		if (MULTI_REGION_RECREATE_BLOCKED_TYPES.has(resourceType)) blockedMultiRegionTargets.push(target);
 		if (resourceType === NESTED_STACK_RESOURCE_TYPE$1 || templateResource.Type === NESTED_STACK_RESOURCE_TYPE$1) blockedNestedStackTargets.push(target);
 		if (direction === "to-cc-api") {
-			const actionableDrops = findActionableSilentDrops(resourceType, templateResource.Properties, EMPTY_ALLOW_SET$1);
+			const actionableDrops = findActionableSilentDrops(resourceType, templateResource.Properties, EMPTY_ALLOW_SET$1, recordedResource.properties, { unresolvedAs: "changed" });
 			for (const { property } of actionableDrops) {
 				const allowKey = `${resourceType}:${property}`;
 				if (input.allowUnsupportedProperties.has(allowKey)) ambiguousIntent.push({
@@ -3084,7 +3084,7 @@ function validateRecreateTargets(input) {
 			}
 			if (recordedResource.provisionedBy === "cc-api") blockedAlreadyCcApi.push(target);
 		} else {
-			const actionableDrops = findActionableSilentDrops(resourceType, templateResource.Properties, input.allowUnsupportedProperties);
+			const actionableDrops = findActionableSilentDrops(resourceType, templateResource.Properties, input.allowUnsupportedProperties, recordedResource.properties, { unresolvedAs: "changed" });
 			for (const { property } of actionableDrops) ambiguousIntentSdk.push({
 				logicalId,
 				resourceType,
@@ -8600,6 +8600,16 @@ function noRecordedRegionCause() {
 		remedy: "This record predates cdkd's region-keyed state layout. Re-deploy the stack to write a record that carries its region, or confirm the bucket's location yourself, to have the guard run on the next destroy."
 	};
 }
+/**
+* A lifecycle rule's `Id` as the warnings print it (go-to-k/cdkd#3617). The id
+* is template-chosen and free-form, so it renders through `displayIdent` --
+* bare when plain, otherwise one JSON string -- rather than inside cdkd's own
+* quotes, which a `'` in it would close. An absent or empty id is named in
+* words.
+*/
+function shownLifecycleRuleId(id) {
+	return id === void 0 || id === null || id === "" ? "(no Id)" : displayIdent(id);
+}
 var S3BucketProvider = class S3BucketProvider {
 	s3Client;
 	logger = getLogger().child("S3BucketProvider");
@@ -8901,7 +8911,7 @@ var S3BucketProvider = class S3BucketProvider {
 			if (coerceCfnBoolean(rule["ExpiredObjectDeleteMarker"]) === true) {
 				const exp = sdkRule.Expiration;
 				if (!(exp?.["Days"] !== void 0 || exp?.["Date"] !== void 0)) sdkRule.Expiration = { ExpiredObjectDeleteMarker: true };
-				else this.logger.warn(`Lifecycle rule '${displaySafe(rule["Id"] ?? "<unnamed>")}' on ${displaySafe(bucketName)} sets ExpiredObjectDeleteMarker alongside an expiration Days/Date; S3 forbids combining them, so the delete-marker cleanup was not applied.`);
+				else this.logger.warn(`Lifecycle rule ${shownLifecycleRuleId(rule["Id"])} on ${displaySafe(bucketName)} sets ExpiredObjectDeleteMarker alongside an expiration Days/Date; S3 forbids combining them, so the delete-marker cleanup was not applied.`);
 			}
 			const nve = isPlainObject$2(rule["NoncurrentVersionExpiration"]) ? rule["NoncurrentVersionExpiration"] : void 0;
 			const legacyNveDays = rule["NoncurrentVersionExpirationInDays"];
@@ -8917,7 +8927,7 @@ var S3BucketProvider = class S3BucketProvider {
 			});
 			const nvts = rule["NoncurrentVersionTransitions"];
 			const singularNvt = rule["NoncurrentVersionTransition"];
-			const allNvts = mergeLegacySingular(nvts, singularNvt, (sc) => this.logger.warn(`Lifecycle rule '${displaySafe(rule["Id"] ?? "<unnamed>")}' on ${displaySafe(bucketName)} declares both NoncurrentVersionTransitions and the legacy NoncurrentVersionTransition for storage class ${displaySafe(sc)}; S3 rejects duplicates, so the legacy singular was ignored.`));
+			const allNvts = mergeLegacySingular(nvts, singularNvt, (sc) => this.logger.warn(`Lifecycle rule ${shownLifecycleRuleId(rule["Id"])} on ${displaySafe(bucketName)} declares both NoncurrentVersionTransitions and the legacy NoncurrentVersionTransition for storage class ${displaySafe(sc)}; S3 rejects duplicates, so the legacy singular was ignored.`));
 			if (allNvts.length > 0) sdkRule.NoncurrentVersionTransitions = allNvts.map(toSdkNvt);
 			const toSdkTransition = (t) => ({
 				Days: t["TransitionInDays"] ?? t["Days"],
@@ -8926,7 +8936,7 @@ var S3BucketProvider = class S3BucketProvider {
 			});
 			const transitions = rule["Transitions"];
 			const singularTransition = rule["Transition"];
-			const allTransitions = mergeLegacySingular(transitions, singularTransition, (sc) => this.logger.warn(`Lifecycle rule '${displaySafe(rule["Id"] ?? "<unnamed>")}' on ${displaySafe(bucketName)} declares both Transitions and the legacy Transition for storage class ${displaySafe(sc)}; S3 rejects duplicates, so the legacy singular was ignored.`));
+			const allTransitions = mergeLegacySingular(transitions, singularTransition, (sc) => this.logger.warn(`Lifecycle rule ${shownLifecycleRuleId(rule["Id"])} on ${displaySafe(bucketName)} declares both Transitions and the legacy Transition for storage class ${displaySafe(sc)}; S3 rejects duplicates, so the legacy singular was ignored.`));
 			if (allTransitions.length > 0) sdkRule.Transitions = allTransitions.map(toSdkTransition);
 			const abort = isPlainObject$2(rule["AbortIncompleteMultipartUpload"]) ? rule["AbortIncompleteMultipartUpload"] : void 0;
 			if (abort) sdkRule.AbortIncompleteMultipartUpload = { DaysAfterInitiation: abort["DaysAfterInitiation"] };
@@ -21135,23 +21145,29 @@ var DynamoDBTableProvider = class {
 	* CALLER-BLIND, decided rather than overlooked (PR review). A TEMPLATE-borne
 	* `{0, 0}` warn-skips here while `create()` fails loudly on the same value,
 	* which reads like the "loud failure for a quiet lie" trade the adopted-index
-	* arm below forbids. It stands for three reasons:
-	*
-	*  - The discriminator that EXISTS does not separate the callers that matter.
-	*    `ResourceProvider.update` DOES take an optional `UpdateContext` — an
-	*    earlier draft of this comment claimed the signature carries no context
-	*    at all, which is simply false (`s3-bucket-provider.ts` consumes it
-	*    today) — but its one field, `desiredFromAwsReadback`, is set ONLY by
-	*    `cdkd drift --revert` (`src/cli/commands/drift.ts`). The rollback
-	*    executor's revert arms deliberately pass NO context: their desired bag
-	*    is `previousState.properties`, a TEMPLATE recorded earlier, so they are
-	*    indistinguishable from an ordinary template deploy — and THAT is the
-	*    pair this decision turns on. Knowing the value came from a readback
-	*    would not license throwing on the other two.
-	*  - With the caller unknowable, the repo's rule for the UPDATE path is
-	*    WARN-never-throw (issues #1545 / #1552): the desired bag here can BE a
-	*    historical cdkd state record, and a refusal would make the table
-	*    un-updatable and un-rollbackable with no template-side remedy.
+	* arm below forbids. It was decided for three reasons; the first no longer
+	* holds as written (see its own bullet), the other two still do:
+	*
+	*  - When this was decided, no discriminator separated the callers that
+	*    matter. `ResourceProvider.update` takes an optional `UpdateContext`, and
+	*    `desiredFromAwsReadback` on it is set ONLY by `cdkd drift --revert`
+	*    (`src/cli/commands/drift.ts`). The rollback executor's revert arms DO
+	*    pass a context (a `maskSecrets` capability, issue #1932) but never set
+	*    that flag: their desired bag is `previousState.properties`, a TEMPLATE
+	*    recorded earlier. At the time they were therefore indistinguishable
+	*    from an ordinary template deploy — and THAT is the pair this decision
+	*    turns on. (An earlier revision said the revert arms "pass NO context",
+	*    which stopped being true with #1932 — issue #1999.) Since issue #3141
+	*    they ALSO set `UpdateContext.replayingState`, so the caller is now
+	*    knowable: the per-index `OnDemandThroughput` refusal in `update()` gates
+	*    on exactly that pair of flags (the go-to-k/cdkd#3401 review). This arm
+	*    was not re-decided when that became possible; splitting it the same way
+	*    would turn a template-path warn-skip into a refusal, a behaviour change
+	*    that needs its own review rather than a comment edit (issue #3728).
+	*  - The repo's general rule for the UPDATE path is WARN-never-throw (issues
+	*    #1545 / #1552): the desired bag here can BE a historical cdkd state
+	*    record, and a refusal would make the table un-updatable and
+	*    un-rollbackable with no template-side remedy.
 	*  - The lie is bounded and self-surfacing. AWS never accepted `{0, 0}` at
 	*    create either, so no live table can be holding it; and where the value
 	*    would actually matter — a PROVISIONED table, whose indexes hold a real
@@ -31657,9 +31673,10 @@ var EC2Provider = class {
 	* narrowing here the template's extra keys read as an ADDED property on the
 	* next deploy — and every destination key is create-only in the registry
 	* schema, so the diff would classify a REPLACEMENT and the engine's
-	* replacement create (which passes no context, and so gets no
-	* `onMultipleDestinations` downgrade) would hit the #1566 refusal. A
-	* previously-green no-op deploy would start failing.
+	* replacement create (whose context carries a `maskSecrets` capability but
+	* never `replayingState`, and so gets no `onMultipleDestinations`
+	* downgrade) would hit the #1566 refusal. A previously-green no-op deploy
+	* would start failing.
 	*
 	* Shares `narrowRouteDestinations` with the provisioning path so the two
 	* cannot disagree about which key survives.
@@ -31668,8 +31685,8 @@ var EC2Provider = class {
 	* half for the same reason: `IpProtocol` is create-only on that type in the
 	* registry schema, so normalizing state alone would make the template's
 	* original value read as a changed immutable property — a REPLACEMENT, whose
-	* create passes no context and so gets no `onUnusable` downgrade, turning a
-	* previously-green no-op deploy into a hard failure. Normalizing BOTH sides
+	* create never sets `replayingState` and so gets no `onUnusable` downgrade,
+	* turning a previously-green no-op deploy into a hard failure. Normalizing BOTH sides
 	* is also what keeps the fix correct for records written BEFORE it existed,
 	* which still carry the un-narrowed value.
 	*/
@@ -51256,6 +51273,40 @@ const GLUE_TABLE_ID_FORMAT = {
 	segments: ["databaseName", "tableName"]
 };
 /**
+* Decode an `AWS::Glue::Table` physicalId `<databaseName>|<tableName>`.
+*
+* The separator is unescaped (issue #1672), so a bare split of an id whose
+* table name carries a `|` returns a DIFFERENT table — `mydb|a|b` splits to
+* `mydb.a`, both halves non-empty, and a delete of it would hit the wrong
+* table. Such ids exist: a state-replay create warns and packs one anyway, and
+* binaries before the #1719 refusal recorded them. The recorded `DatabaseName`
+* disambiguates the id without re-deriving the identity from the bag: it is
+* used only when the id starts with it, and the table name is the remainder.
+*
+* `bags` are tried in order, so pass the one describing what was DEPLOYED
+* first. With no usable anchor only an id with exactly one separator decodes;
+* anything longer is ambiguous and returns `undefined`, the malformed-id arm
+* every caller already has.
+*/
+function decodeTableId(physicalId, ...bags) {
+	for (const bag of bags) {
+		const databaseName = bag?.["DatabaseName"];
+		if (typeof databaseName !== "string" || databaseName === "") continue;
+		if (!physicalId.startsWith(`${databaseName}|`)) continue;
+		const tableName = physicalId.slice(databaseName.length + 1);
+		if (tableName !== "") return {
+			databaseName,
+			tableName
+		};
+	}
+	const parts = physicalId.split("|");
+	if (parts.length !== 2 || !parts[0] || !parts[1]) return void 0;
+	return {
+		databaseName: parts[0],
+		tableName: parts[1]
+	};
+}
+/**
 * Read a template-borne value that is about to be forwarded to a Glue read
 * API as a string.
 *
@@ -51585,8 +51636,9 @@ var GlueProvider = class {
 	}
 	async updateTable(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating Glue Table ${logicalId}: ${physicalId}`);
-		const [databaseName, tableName] = physicalId.split("|");
-		if (!databaseName || !tableName) throw new ProvisioningError(compositeIdFormatMessage(GLUE_TABLE_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
+		const decoded = decodeTableId(physicalId, previousProperties, properties);
+		if (!decoded) throw new ProvisioningError(compositeIdFormatMessage(GLUE_TABLE_ID_FORMAT, logicalId, physicalId), resourceType, logicalId, physicalId);
+		const { databaseName, tableName } = decoded;
 		const tableInput = properties["TableInput"];
 		if (!tableInput) throw new ProvisioningError(`TableInput is required for Glue Table update ${logicalId}`, resourceType, logicalId, physicalId);
 		const catalogId = properties["CatalogId"];
@@ -51621,11 +51673,12 @@ var GlueProvider = class {
 	}
 	async deleteTable(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting Glue Table ${logicalId}: ${physicalId}`);
-		const [databaseName, tableName] = physicalId.split("|");
-		if (!databaseName || !tableName) {
+		const decoded = decodeTableId(physicalId, properties);
+		if (!decoded) {
 			this.logger.warn(compositeIdFormatMessage(GLUE_TABLE_ID_FORMAT, logicalId, physicalId, { skipping: true }));
 			return compositeIdSkipResult();
 		}
+		const { databaseName, tableName } = decoded;
 		const target = deleteCatalogId(properties);
 		if (target.declaredButUnusable) this.logger.debug(`Glue Table ${logicalId}: CatalogId is not a usable value (likely an unresolved intrinsic), so DeleteTable targets ${describeCatalog(target.catalogId)}.`);
 		try {
@@ -51897,9 +51950,12 @@ var GlueProvider = class {
 	*     downgrades through the shared `replayWarn`, since a reverse-replacement
 	*     re-create reads a STATE record the user cannot edit from the template.
 	*   - UPDATE passes a warn callback UNCONDITIONALLY (the `updateRoute`
-	*     precedent — `update()` has no context, so it cannot tell a template
-	*     push from the state-borne bag `drift --revert` and the rollback revert
-	*     arm hand it), and then RETAINS the PREVIOUS side's block, which is why
+	*     precedent, decided when `update()` could not tell a template push
+	*     from the state-borne bag `drift --revert` and the rollback revert arm
+	*     hand it — since issue #3141 `UpdateContext.replayingState` plus
+	*     `desiredFromAwsReadback` can, and this arm was not re-decided — issue
+	*     #3728), and
+	*     then RETAINS the PREVIOUS side's block, which is why
 	*     `previousDatabaseInput` is threaded in. Omitting instead would ERASE a
 	*     live resource link, because `UpdateDatabase` replaces `DatabaseInput`
 	*     wholesale — the #1612 "UPDATE retains the previous value" row, reached
@@ -52112,7 +52168,7 @@ var GlueProvider = class {
 		const catalogId = catalogIdForApi(properties?.["CatalogId"]);
 		switch (resourceType) {
 			case "AWS::Glue::Database": return this.readDatabase(physicalId, catalogId);
-			case "AWS::Glue::Table": return this.readTable(physicalId, catalogId);
+			case "AWS::Glue::Table": return this.readTable(physicalId, catalogId, properties);
 			default: return;
 		}
 	}
@@ -52175,9 +52231,10 @@ var GlueProvider = class {
 		if (db.Name !== void 0) result["DatabaseName"] = db.Name;
 		return result;
 	}
-	async readTable(physicalId, catalogId) {
-		const [databaseName, tableName] = physicalId.split("|");
-		if (!databaseName || !tableName) return void 0;
+	async readTable(physicalId, catalogId, properties) {
+		const decoded = decodeTableId(physicalId, properties);
+		if (!decoded) return void 0;
+		const { databaseName, tableName } = decoded;
 		let table;
 		try {
 			table = (await this.getClient().send(new GetTableCommand({
@@ -52421,8 +52478,19 @@ var GlueWorkflowProvider = class {
 		}
 		return null;
 	}
+	/**
+	* The workflow ARN `GetTags` needs. The partition is derived from the
+	* client's region (issue #1815): the literal `arn:aws:` is structurally valid
+	* everywhere, so in `aws-cn` / `aws-us-gov` nothing rejected it — `GetTags`
+	* was simply aimed at an ARN naming no workflow, and the best-effort catch
+	* below reads a failure there as EMPTY tags. A commercial region still derives to `aws`,
+	* so commercial output is unchanged byte for byte.
+	*/
 	async buildWorkflowArn(workflowName) {
-		return `arn:aws:glue:${await this.getRegion()}:${await this.getAccountId()}:workflow/${workflowName}`;
+		const region = await this.getRegion();
+		const account = await this.getAccountId();
+		const { partition } = derivePartitionAndUrlSuffix(region);
+		return `arn:${partition}:glue:${region}:${account}:workflow/${workflowName}`;
 	}
 	async getRegion() {
 		return await this.getClient().config.region() || this.providerRegion || "us-east-1";
@@ -52640,8 +52708,18 @@ function findIcebergTableInputKey(properties) {
 * must never call `this.create()` from inside its own `update()` the way ACM /
 * IAM / Lambda-permission / SNS-subscription do: those internal re-creates
 * forward `update()`'s `properties` — a STATE record during a rollback replay —
-* and `update()` has no context parameter to carry the flag, so this refusal
-* would fire on a replay with no way to detect it.
+* and pass no `CreateContext`, so this refusal would fire on a replay with no
+* way to detect it. (`update()` DOES take a context — an `UpdateContext` since
+* issue #1732 — and since issue #3141 that context carries its own
+* `replayingState`, set by the rollback executor's two revert arms. So the
+* information now reaches `update()`; what is missing is a re-create that
+* builds a `CreateContext` from it, and none of those providers does. An
+* earlier revision said `update()` had "no context parameter to carry the
+* flag" — issue #1999.) Were GlueProvider ever to re-create inside `update()`,
+* it would have to forward a replay signal into that `create()` —
+* `context.replayingState` on the rollback path — and decide separately what
+* this refusal means for the `desiredFromAwsReadback` bag `cdkd drift --revert`
+* hands it, since that path sets no `replayingState`.
 *
 * **Known bypass: the sticky Cloud Control route.** This is a GlueProvider
 * pre-flight, so it only runs on the SDK route. When a table's state record
@@ -52747,11 +52825,22 @@ function cleanCfnObject(obj) {
 }
 /**
 * Build the ARN for a Glue resource. Used by tag-fetch via
-* `GetTagsCommand` which only accepts an ARN. Account id falls back
-* to STS when not provided.
+* `GetTagsCommand` which only accepts an ARN, and by the Job / Crawler /
+* Trigger `applyTagDiff` as the `TagResource` / `UntagResource` target.
+* Account id falls back to STS when not provided.
+*
+* The partition is derived from the region (issue #1815). A hardcoded
+* `arn:aws:` is structurally valid everywhere, so in `aws-cn` / `aws-us-gov`
+* nothing rejected it: the tag MUTATION was aimed at an ARN naming no
+* resource, and the drift read's best-effort `GetTags` read the failure as
+* empty tags. A commercial region still derives to `aws`, so commercial output
+* is unchanged byte for byte.
 */
 async function buildGlueResourceArn(client, stsClient, resource, name, accountId) {
-	return `arn:aws:glue:${await client.config.region() || ambientRegion() || "us-east-1"}:${accountId ?? await resolveAccountId(stsClient)}:${resource}/${name}`;
+	const region = await client.config.region() || ambientRegion() || "us-east-1";
+	const account = accountId ?? await resolveAccountId(stsClient);
+	const { partition } = derivePartitionAndUrlSuffix(region);
+	return `arn:${partition}:glue:${region}:${account}:${resource}/${name}`;
 }
 async function resolveAccountId(stsClient) {
 	const identity = await stsClient.send(new GetCallerIdentityCommand({}));
@@ -65583,13 +65672,13 @@ var NestedStackProvider = class {
 		try {
 			raw = fs.readFileSync(templatePath, "utf-8");
 		} catch (err) {
-			throw new Error(`Failed to read nested template at ${displayAssemblyPath(templatePath)}: ${displaySafe(err instanceof Error ? err.message : String(err))}`);
+			throw new Error(`Failed to read nested template at ${displayAssemblyPath(templatePath)}: ${describeFileReadFailure(err, templatePath)}`);
 		}
 		let template;
 		try {
 			template = JSON.parse(raw);
 		} catch (err) {
-			throw new Error(`Failed to parse nested template at ${displayAssemblyPath(templatePath)}: ${displaySafe(err instanceof Error ? err.message : String(err))}`);
+			throw new Error(`Failed to parse nested template at ${displayAssemblyPath(templatePath)}: ${describeFileReadFailure(err, templatePath)}`);
 		}
 		const grandchildTemplates = this.indexGrandchildTemplates(template, templatePath);
 		if (assetRedirect) {
@@ -68503,12 +68592,12 @@ function readNestedTemplate(templatePath) {
 	try {
 		raw = fs.readFileSync(templatePath, "utf-8");
 	} catch (err) {
-		throw new Error(`Failed to read nested template at ${templatePath}: ${err instanceof Error ? err.message : String(err)}`);
+		throw new Error(`Failed to read nested template at ${displayAssemblyPath(templatePath)}: ${describeFileReadFailure(err, templatePath)}`);
 	}
 	try {
 		return JSON.parse(raw);
 	} catch (err) {
-		throw new Error(`Failed to parse nested template at ${templatePath}: ${err instanceof Error ? err.message : String(err)}`);
+		throw new Error(`Failed to parse nested template at ${displayAssemblyPath(templatePath)}: ${describeFileReadFailure(err, templatePath)}`);
 	}
 }
 /**
@@ -68527,9 +68616,9 @@ function indexNestedChildTemplates(template, templatePath) {
 		if (resource?.Type !== "AWS::CloudFormation::Stack") continue;
 		const assetPath = resource.Metadata?.["aws:asset:path"];
 		if (typeof assetPath !== "string" || assetPath.length === 0) continue;
-		if (isAbsoluteCrossPlatform(assetPath)) throw new Error(`Nested stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`);
+		if (isAbsoluteCrossPlatform(assetPath)) throw new Error(`Nested stack ${displayIdent(logicalId)} has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which is absolute. CDK emits relative asset paths for nested templates; an absolute path indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to load.`);
 		const resolved = resolveAssemblyPath(dir, assetPath);
-		if (!resolved.contained) throw new Error(`Nested stack '${displaySafe(logicalId)}' has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which ${renderAssemblyPathEscape(resolved, dir)}`);
+		if (!resolved.contained) throw new Error(`Nested stack ${displayIdent(logicalId)} has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which ${renderAssemblyPathEscape(resolved, dir)}`);
 		result[logicalId] = resolved.path;
 	}
 	return result;
@@ -68685,7 +68774,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 	const tokenParameterNames = new Set(Object.entries(parameters ?? {}).filter(([, value]) => carriesDynamicReference(value)).map(([name]) => name));
 	for (const name of tokenParameterNames) {
 		const declaredType = (template.Parameters?.[name])?.Type;
-		if (typeof declaredType === "string" && parameterTypeMayLoseSecretIdentity(declaredType)) logger.warn(`Stack ${stripControlChars(stackName)}: parameter '${stripControlChars(name)}' is declared 'Type: ${stripControlChars(declaredType)}' and is fed a secret dynamic reference. 'cdkd deploy' refuses this when the coercion actually destroys the plaintext (a comma-bearing secret in a list-typed parameter) — declare it 'Type: String' — and this diff compares the unresolved reference, shaped by the declared type only where that keeps every part of it a string.`);
+		if (typeof declaredType === "string" && parameterTypeMayLoseSecretIdentity(declaredType)) logger.warn(`Stack ${displayStackName(stackName)}: parameter ${displayIdent(name)} is declared Type: ${displayIdent(declaredType)} and is fed a secret dynamic reference. 'cdkd deploy' refuses this when the coercion actually destroys the plaintext (a comma-bearing secret in a list-typed parameter) — declare it 'Type: String' — and this diff compares the unresolved reference, shaped by the declared type only where that keeps every part of it a string.`);
 	}
 	try {
 		const userParameters = {};
@@ -68701,7 +68790,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		}
 		parametersBound = true;
 	} catch (error) {
-		logger.debug(`Diff parameter binding for stack ${stackName} is partial: ${error instanceof Error ? error.message : String(error)}`);
+		logger.debug(`Diff parameter binding for stack ${displayStackName(stackName)} is partial: ${error instanceof Error ? error.message : String(error)}`);
 	}
 	let effectiveTemplate = template;
 	let conditions;
@@ -68716,7 +68805,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		});
 		effectiveTemplate = new TemplateParser().filterResourcesByCondition(template, conditions);
 	} catch (error) {
-		logger.debug(`Diff condition evaluation for stack ${stackName} skipped: ${error instanceof Error ? error.message : String(error)}`);
+		logger.debug(`Diff condition evaluation for stack ${displayStackName(stackName)} skipped: ${error instanceof Error ? error.message : String(error)}`);
 	}
 	const resolveFn = (value) => intrinsicResolver.resolve(value, {
 		template: effectiveTemplate,
@@ -68929,10 +69018,10 @@ async function buildDiffTree(args) {
 		if (resource?.Type !== "AWS::CloudFormation::Stack") continue;
 		templateChildIds.add(logicalId);
 		const childTemplatePath = nestedTemplates[logicalId];
-		if (!childTemplatePath) throw new Error(`Nested template file not found for ${NESTED_STACK_RESOURCE_TYPE} '${logicalId}' under stack '${stackName}'. Verify the synth output emits Metadata['aws:asset:path'] on this resource (CDK 2.x cdk.NestedStack does so by default), then re-run synth.`);
+		if (!childTemplatePath) throw new Error(`Nested template file not found for ${NESTED_STACK_RESOURCE_TYPE} ${displayIdent(logicalId)} under stack ${displayStackName(stackName)}. Verify the synth output emits Metadata['aws:asset:path'] on this resource (CDK 2.x cdk.NestedStack does so by default), then re-run synth.`);
 		const childStackName = `${stackName}~${logicalId}`;
 		const resolvedChildPath = path.resolve(childTemplatePath);
-		if (ancestorTemplatePaths?.has(resolvedChildPath) === true) throw new Error(`Nested stack '${displaySafe(logicalId)}' under stack '${displaySafe(stackName)}' resolves to nested template ${displayAssemblyPath(resolvedChildPath)}, which is already being diffed higher up the same nesting chain. Its Metadata['aws:asset:path'] closes a cycle; CDK emits an acyclic nested template tree, so this indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to diff.`);
+		if (ancestorTemplatePaths?.has(resolvedChildPath) === true) throw new Error(`Nested stack ${displayIdent(logicalId)} under stack ${displayStackName(stackName)} resolves to nested template ${displayAssemblyPath(resolvedChildPath)}, which is already being diffed higher up the same nesting chain. Its Metadata['aws:asset:path'] closes a cycle; CDK emits an acyclic nested template tree, so this indicates the synth output was hand-modified or generated by a non-CDK toolchain. Refusing to diff.`);
 		const childAncestorTemplatePaths = new Set(ancestorTemplatePaths ?? []).add(resolvedChildPath);
 		const childTemplate = readNestedTemplate(childTemplatePath);
 		if (assetRedirect) rewriteTemplateAssetReferences(childTemplate, assetRedirect);
@@ -69028,7 +69117,7 @@ function collectCcApiRoutes(template, state) {
 		if (!resource) continue;
 		if (resource.Type === "AWS::CDK::Metadata") continue;
 		if (resource.Type === "AWS::CloudFormation::Stack") continue;
-		const drops = findActionableSilentDrops(resource.Type, resource.Properties, EMPTY_ALLOW_SET);
+		const drops = findActionableSilentDrops(resource.Type, resource.Properties, EMPTY_ALLOW_SET, state.resources[logicalId]?.properties);
 		if (drops.length > 0) {
 			hits.set(logicalId, drops.map((d) => d.property));
 			continue;
@@ -69246,7 +69335,7 @@ function renderChangeLines(changes, logFn, ccApiRoutes, adoptedOrphans) {
 			logFn(`  [~] ${logicalId} (${change.resourceType})${annotateAdoption(logicalId)}${annotateRouting(logicalId)}`);
 			if (change.propertyChanges && change.propertyChanges.length > 0) for (const propChange of change.propertyChanges) {
 				const requiresReplace = propChange.requiresReplacement ? " [requires replacement]" : "";
-				const propagated = propChange.replacementPropagated ? " [replacement propagated]" : "";
+				const propagated = propChange.replacementPropagated ? " [replacement propagated]" : propChange.inPlacePropagated ? " [attribute propagated]" : "";
 				const indent = "              ";
 				const [oldFiltered, newFiltered] = stripUnchangedValuePair(propChange.oldValue, propChange.newValue);
 				const oldStr = renderDiffValue(propChange.oldValue, oldFiltered, indent, false);
@@ -69672,7 +69761,7 @@ function describeFailure(err) {
 * thing the paragraph above rejects.
 */
 function scrubStacksFailedError(failures) {
-	return new ScrubRefusalError(`${failures.length} stack(s) could not be scrubbed: ${failures.map((f) => f.stackName).join(", ")}. Each one's reason was logged as it happened — see the 'Scrub of <stack> failed:' line above for it.`, "SCRUB_STACKS_FAILED");
+	return new ScrubRefusalError(`${failures.length} stack(s) could not be scrubbed: ${failures.map((f) => displayStackName(f.stackName)).join(", ")}. Each one's reason was logged as it happened — see the 'Scrub of <stack> failed:' line above for it.`, "SCRUB_STACKS_FAILED");
 }
 /**
 * Which of `entries` this stack's post-scrub `outputs` bag disagrees with.
@@ -69751,8 +69840,8 @@ function planExportIndexRepair(entries, stackName, producerRegion, outputs) {
 */
 function exportIndexIncompleteError(unwritten, unreadable, dryRun) {
 	const parts = [dryRun ? "no state written (--dry-run)" : "state.json complete"];
-	if (unwritten.length > 0) parts.push(`${unwritten.length} exports index entr${unwritten.length === 1 ? "y" : "ies"} unwritten (${unwritten.map((u) => `${u.shown} in ${u.region}`).join(", ")})`);
-	if (unreadable.length > 0) parts.push(`${unreadable.length} region(s) whose exports index could not be read (${unreadable.map((u) => `${u.region}: ${u.reason}`).join("; ")})`);
+	if (unwritten.length > 0) parts.push(`${unwritten.length} exports index entr${unwritten.length === 1 ? "y" : "ies"} unwritten (${unwritten.map((u) => `${u.shown} in ${displayIdent(u.region)}`).join(", ")})`);
+	if (unreadable.length > 0) parts.push(`${unreadable.length} region(s) whose exports index could not be read (${unreadable.map((u) => `${displayIdent(u.region)}: ${u.reason}`).join("; ")})`);
 	return new ScrubRefusalError(`${parts.join("; ")}. Re-run the same command once the cause is cleared: each entry is written only while its value differs from the producer's state.outputs, so a re-run writes the remainder and leaves the rest alone.`, "SCRUB_EXPORT_INDEX_INCOMPLETE");
 }
 /**
@@ -69983,6 +70072,7 @@ async function scrubCommand(stacks, options) {
 	const indexUnwritten = [];
 	const indexUnreadable = [];
 	for (const stack of targetStacks) {
+		const shownStack = displayStackName(stack.stackName);
 		const stackRegion = stack.region || region;
 		let scrubbed;
 		try {
@@ -69994,7 +70084,7 @@ async function scrubCommand(stacks, options) {
 			});
 		} catch (err) {
 			failures.push({ stackName: stack.stackName });
-			logger.error(`Scrub of ${stack.stackName} failed: ${describeFailure(err)}`);
+			logger.error(`Scrub of ${shownStack} failed: ${describeFailure(err)}`);
 			if (err instanceof Error && err.stack) logger.debug("Stack trace:", err.stack);
 			continue;
 		}
@@ -70007,8 +70097,8 @@ async function scrubCommand(stacks, options) {
 			const named = (exportName) => {
 				const shown = scrubbed.exportNameDisplay(exportName);
 				switch (shown.kind) {
-					case "safe": return `'${shown.text}'`;
-					case "masked": return `(masked: "${shown.text}")`;
+					case "safe": return displayIdent(shown.text);
+					case "masked": return `(masked: ${displayIdent(shown.text)})`;
 					case "withheld": return "(name withheld: it holds a secret this run recorded)";
 				}
 			};
@@ -70019,14 +70109,14 @@ async function scrubCommand(stacks, options) {
 			});
 			for (const finding of repair.findings) if (finding.kind === "converge") {
 				indexConverged++;
-				if (!options.dryRun && unwrittenNames.has(finding.exportName)) logger.warn(`Exports index entry ${named(finding.exportName)} (${stackRegion}) differs from ${stack.stackName}'s state.outputs and could NOT be written — it keeps the value it holds.`);
+				if (!options.dryRun && unwrittenNames.has(finding.exportName)) logger.warn(`Exports index entry ${named(finding.exportName)} (${displayIdent(stackRegion)}) differs from ${shownStack}'s state.outputs and could NOT be written — it keeps the value it holds.`);
 				else {
 					totalIndexEntriesConverged++;
-					logger.info(`${options.dryRun ? "Would converge" : "Converged"} exports index entry ${named(finding.exportName)} (${stackRegion}) to ${stack.stackName}'s state.outputs value.`);
+					logger.info(`${options.dryRun ? "Would converge" : "Converged"} exports index entry ${named(finding.exportName)} (${displayIdent(stackRegion)}) to ${shownStack}'s state.outputs value.`);
 				}
 			} else {
 				totalIndexEntriesAbsent++;
-				logger.warn(`Exports index entry ${named(finding.exportName)} (${stackRegion}) is published by ${stack.stackName}, whose state.outputs has no key of that name — nothing was written for it and it keeps the value it holds. Redeploy ${stack.stackName} to rewrite the index from its own outputs.`);
+				logger.warn(`Exports index entry ${named(finding.exportName)} (${displayIdent(stackRegion)}) is published by ${shownStack}, whose state.outputs has no key of that name — nothing was written for it and it keeps the value it holds. Redeploy ${shownStack} to rewrite the index from its own outputs.`);
 			}
 		} catch (err) {
 			if (err instanceof ScrubIndexInvariantError) throw err;
@@ -70036,28 +70126,28 @@ async function scrubCommand(stacks, options) {
 					region: stackRegion,
 					reason
 				});
-				logger.error(`Exports index for ${stackRegion} could not be read (first seen while scrubbing ${stack.stackName}): ${reason}`);
+				logger.error(`Exports index for ${displayIdent(stackRegion)} could not be read (first seen while scrubbing ${shownStack}): ${reason}`);
 			}
 		}
 		if (scrubbed.recordsChanged > 0) {
 			totalStacksScrubbed++;
-			logger.info(`${options.dryRun ? "Would scrub" : "Scrubbed"} ${scrubbed.recordsChanged} resource record(s) in ${stack.stackName}`);
-		} else if (scrubbed.secretBearingKeys === 0 && scrubbed.unverifiableReads === 0 && scrubbed.unverifiableLeaves === 0 && indexConverged === 0) logger.info(`No plaintext secrets found in ${stack.stackName}`);
+			logger.info(`${options.dryRun ? "Would scrub" : "Scrubbed"} ${scrubbed.recordsChanged} resource record(s) in ${shownStack}`);
+		} else if (scrubbed.secretBearingKeys === 0 && scrubbed.unverifiableReads === 0 && scrubbed.unverifiableLeaves === 0 && indexConverged === 0) logger.info(`No plaintext secrets found in ${shownStack}`);
 		if (scrubbed.malformedResources) malformedRecords.push(stack.stackName);
 		if (scrubbed.malformedOutputs) malformedOutputRecords.push(stack.stackName);
 		if (scrubbed.malformedOrphans || scrubbed.malformedOrphanRows) malformedOrphanRecords.push(stack.stackName);
 		if (scrubbed.unverifiableLeaves > 0) {
 			totalStacksWithUnverifiableLeaves++;
-			logger.warn(`${scrubbed.unverifiableLeaves} scan(s) in ${stack.stackName} were ABANDONED mid-value because a {{resolve:...}} reference could not be resolved (see the warnings above). The resolver stops at the first failing token, so a real secret after it in the same value recorded no needle — this stack is not reported clean. The count is per abandoned SCAN, not per secret: one record can contribute more than once (an output whose Export.Name and Value both abandon), and one abandoned scan can hide several unexamined leaves.`);
+			logger.warn(`${scrubbed.unverifiableLeaves} scan(s) in ${shownStack} were ABANDONED mid-value because a {{resolve:...}} reference could not be resolved (see the warnings above). The resolver stops at the first failing token, so a real secret after it in the same value recorded no needle — this stack is not reported clean. The count is per abandoned SCAN, not per secret: one record can contribute more than once (an output whose Export.Name and Value both abandon), and one abandoned scan can hide several unexamined leaves.`);
 		}
 		if (scrubbed.unverifiableProducerRecords > 0) damagedProducerStacks.push(stack.stackName);
 		if (scrubbed.unverifiableReads > 0) {
 			totalStacksWithUnverifiableReads++;
-			logger.warn(`${scrubbed.unverifiableReads} cross-stack read(s) in ${stack.stackName} could NOT be verified (see the warnings above for which, and why) — so this stack is not reported clean.`);
+			logger.warn(`${scrubbed.unverifiableReads} cross-stack read(s) in ${shownStack} could NOT be verified (see the warnings above for which, and why) — so this stack is not reported clean.`);
 		}
 		if (scrubbed.secretBearingKeys > 0) {
 			totalStacksWithUnscrubbableKeys++;
-			logger.warn(`${scrubbed.secretBearingKeys} output KEY(s) in ${stack.stackName} hold plaintext and CANNOT be scrubbed — rename the Export.Name and redeploy (see the warning above).`);
+			logger.warn(`${scrubbed.secretBearingKeys} output KEY(s) in ${shownStack} hold plaintext and CANNOT be scrubbed — rename the Export.Name and redeploy (see the warning above).`);
 		}
 	}
 	for (const [indexRegion, store] of exportIndexStores) {
@@ -70071,7 +70161,7 @@ async function scrubCommand(stacks, options) {
 				region: indexRegion,
 				reason
 			});
-			logger.error(`Exports index for ${indexRegion} could not be read for the coverage report: ${reason}`);
+			logger.error(`Exports index for ${displayIdent(indexRegion)} could not be read for the coverage report: ${reason}`);
 			continue;
 		}
 		if (!entries) continue;
@@ -70079,7 +70169,7 @@ async function scrubCommand(stacks, options) {
 		const unexamined = [...entries.keys()].filter((name) => !examined.has(name));
 		if (unexamined.length === 0) continue;
 		totalIndexEntriesUnexamined += unexamined.length;
-		logger.info(`Exports index (${indexRegion}): ${unexamined.length} entr${unexamined.length === 1 ? "y is" : "ies are"} published by a producer this run did not scrub, so nothing here read ${unexamined.length === 1 ? "its" : "their"} value. Coverage composes across the apps sharing this bucket and region — run each app's own cdkd scrub to reach its entries.`);
+		logger.info(`Exports index (${displayIdent(indexRegion)}): ${unexamined.length} entr${unexamined.length === 1 ? "y is" : "ies are"} published by a producer this run did not scrub, so nothing here read ${unexamined.length === 1 ? "its" : "their"} value. Coverage composes across the apps sharing this bucket and region — run each app's own cdkd scrub to reach its entries.`);
 	}
 	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0 && totalStacksWithUnverifiableLeaves === 0 && totalIndexEntriesConverged === 0 && indexUnwritten.length === 0 && indexUnreadable.length === 0 && malformedRecords.length === 0 && malformedOutputRecords.length === 0 && malformedOrphanRecords.length === 0) {
 		if (failures.length === 0) {
@@ -70370,8 +70460,8 @@ var ScrubResolvers = class {
 * Never the resolved value: nothing has been resolved for this reference, and
 * the expression is the same string `state.json` already stores in the clear.
 */
-function regionAmbiguousScrubSecretError(origin, stackName, secretName, foreignProducerRegions, stackRegion) {
-	return new ScrubRefusalError(`Scrub of ${stackName} cannot re-resolve the secret reference '${secretName}' in ${origin}: the reference carries no region of its own, and this stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.join(", ")}), so it may have been resolved in one of those rather than in '${stackRegion}'. A secret of the same name in two regions is two independent values, so scrub would look for the WRONG plaintext — leaving the real one in state while reporting the stack clean, and using the foreign value as a needle that can rewrite an unrelated literal. Refusing instead. Spell the reference as a full ARN, which names its region and is resolved there, then re-run 'cdkd scrub'.`, "SCRUB_SECRET_REGION_AMBIGUOUS");
+function regionAmbiguousScrubSecretError(origin, stackName, secretName, foreignProducerRegions, stackRegion, secrets) {
+	return new ScrubRefusalError(`Scrub of ${displayStackName(stackName)} cannot re-resolve the secret reference ${maskedIdent(secretName, secrets)} in ${origin}: the reference carries no region of its own, and this stack read across a region boundary (producer region(s) on record: ${foreignProducerRegions.map((r) => displayIdent(r)).join(", ")}), so it may have been resolved in one of those rather than in ${displayIdent(stackRegion)}. A secret of the same name in two regions is two independent values, so scrub would look for the WRONG plaintext — leaving the real one in state while reporting the stack clean, and using the foreign value as a needle that can rewrite an unrelated literal. Refusing instead. Spell the reference as a full ARN, which names its region and is resolved there, then re-run 'cdkd scrub'.`, "SCRUB_SECRET_REGION_AMBIGUOUS");
 }
 /**
 * The refusal a `named-region` reference raises when its OWN region cannot
@@ -70389,7 +70479,7 @@ function regionAmbiguousScrubSecretError(origin, stackName, secretName, foreignP
 * into, so a value recorded a moment earlier in this very leaf is covered.
 */
 function unresolvableForeignScrubSecretError(origin, stackName, secretName, region, cause, secrets) {
-	return new ScrubRefusalError(`Scrub of ${stackName} could not resolve the secret reference '${secretName}' in ${origin} in the region its ARN names ('${region}'): ${maskSecretsInText(cause instanceof Error ? cause.message : String(cause), secrets)}. Refusing rather than resolving it in the stack's own region, which would look for a different secret's value and report the stack clean over state that still holds the plaintext.`, "SCRUB_CROSS_REGION_SECRET_UNRESOLVED");
+	return new ScrubRefusalError(`Scrub of ${displayStackName(stackName)} could not resolve the secret reference ${maskedIdent(secretName, secrets)} in ${origin} in the region its ARN names (${displayIdent(region)}): ${maskSecretsInText(cause instanceof Error ? cause.message : String(cause), secrets)}. Refusing rather than resolving it in the stack's own region, which would look for a different secret's value and report the stack clean over state that still holds the plaintext.`, "SCRUB_CROSS_REGION_SECRET_UNRESOLVED");
 }
 /**
 * The literal that OPENS a dynamic reference. Used as the CHEAP pre-filter that
@@ -70537,17 +70627,18 @@ function isAssembledSecretReference(leaf, secretTokens) {
 * together out of a plaintext is not.
 */
 async function resolveForeignRegionTokens(leaf, stackName, ctx) {
+	const shownStackName = displayStackName(stackName);
 	const tokens = dynamicReferenceTokens(leaf);
 	if (isAssembledSecretReference(leaf, tokens.filter(isSecretReferenceToken))) return leaf;
 	const verdicts = tokens.map((token) => [token, classifyReplaySecretRegion(token, ctx.stackRegion, ctx.producerRegions)]);
-	for (const [, verdict] of verdicts) if (verdict.kind === "ambiguous") throw regionAmbiguousScrubSecretError(ctx.origin, stackName, verdict.secretName, verdict.foreignProducerRegions, ctx.stackRegion);
+	for (const [, verdict] of verdicts) if (verdict.kind === "ambiguous") throw regionAmbiguousScrubSecretError(ctx.origin, stackName, verdict.secretName, verdict.foreignProducerRegions, ctx.stackRegion, ctx.recordedSecretValues);
 	if (!verdicts.some(([, verdict]) => verdict.kind === "named-region")) return leaf;
 	const localTokens = [];
 	let out = "";
 	let cursor = 0;
 	for (const [token, verdict] of verdicts) {
 		const at = leaf.indexOf(token, cursor);
-		if (at < 0) throw new ScrubRefusalError(`Scrub of ${stackName} could not locate a scanned dynamic reference in ${ctx.origin}, in the value it was scanned from. Refusing rather than resolving it in '${ctx.stackRegion}', which would be the wrong region for a reference that names another one. This is an internal invariant failure — please report it with the resource type and property path.`, "SCRUB_SECRET_TOKEN_SCAN_MISMATCH");
+		if (at < 0) throw new ScrubRefusalError(`Scrub of ${shownStackName} could not locate a scanned dynamic reference in ${ctx.origin}, in the value it was scanned from. Refusing rather than resolving it in ${displayIdent(ctx.stackRegion)}, which would be the wrong region for a reference that names another one. This is an internal invariant failure — please report it with the resource type and property path.`, "SCRUB_SECRET_TOKEN_SCAN_MISMATCH");
 		out += leaf.slice(cursor, at);
 		if (verdict.kind === "named-region") {
 			const resolver = ctx.resolvers.forRegion(verdict.region);
@@ -70568,7 +70659,7 @@ async function resolveForeignRegionTokens(leaf, stackName, ctx) {
 	}
 	out += leaf.slice(cursor);
 	const surviving = dynamicReferenceTokens(out);
-	if (surviving.length !== localTokens.length || surviving.some((token, i) => token !== localTokens[i])) throw new ScrubRefusalError(`Scrub of ${stackName} refused ${ctx.origin}: resolving a cross-region secret reference produced a value that is itself dynamic-reference shaped, which the stack's own resolver would then resolve as if it were a reference of this stack's. Refusing rather than passing it on.`, "SCRUB_SECRET_RESOLUTION_REINTRODUCED_TOKEN");
+	if (surviving.length !== localTokens.length || surviving.some((token, i) => token !== localTokens[i])) throw new ScrubRefusalError(`Scrub of ${shownStackName} refused ${ctx.origin}: resolving a cross-region secret reference produced a value that is itself dynamic-reference shaped, which the stack's own resolver would then resolve as if it were a reference of this stack's. Refusing rather than passing it on.`, "SCRUB_SECRET_RESOLUTION_REINTRODUCED_TOKEN");
 	return out;
 }
 /**
@@ -70875,7 +70966,7 @@ function effectiveIntrinsicKey(node) {
 * can carry one, and the map is the same one this pass records into.
 */
 function unresolvableCrossStackReadError(origin, stackName, intrinsic, path, cause, secrets) {
-	return new ScrubRefusalError(`Scrub of ${stackName} could not resolve the ${intrinsic} in ${origin}${path ? ` at ${path}` : ""}: ${maskSecretsInText(cause instanceof Error ? cause.message : String(cause), secrets)}. Refusing rather than continuing: the value that reference carries may be a secret, and scrub would then have no plaintext to look for — reporting the stack clean over state that still holds it. Deploy the producer stack (or correct the reference) and re-run 'cdkd scrub'.`, "SCRUB_CROSS_STACK_READ_UNRESOLVED");
+	return new ScrubRefusalError(`Scrub of ${displayStackName(stackName)} could not resolve the ${intrinsic} in ${origin}${path ? ` at ${maskedIdent(path, secrets)}` : ""}: ${maskSecretsInText(cause instanceof Error ? cause.message : String(cause), secrets)}. Refusing rather than continuing: the value that reference carries may be a secret, and scrub would then have no plaintext to look for — reporting the stack clean over state that still holds it. Deploy the producer stack (or correct the reference) and re-run 'cdkd scrub'.`, "SCRUB_CROSS_STACK_READ_UNRESOLVED");
 }
 /**
 * The two sentences the plaintext-producer refusal is built from: what the
@@ -70919,8 +71010,10 @@ function unresolvableCrossStackReadError(origin, stackName, intrinsic, path, cau
 function scrubRefusalWording(verdict, loggedExportKey, loggedProducerStack, loggedVia) {
 	const chain = dedupePreservingOrder(loggedVia, "first");
 	const chainRoot = chain[chain.length - 1];
-	const through = chain.length > 1 ? ` (through ${chain.slice(0, -1).map((s) => `'${s}'`).join(", ")})` : "";
-	const templateClaim = verdict.kind === "declared" ? `declares '${loggedExportKey}' from a {{resolve:...}} expression` : verdict.kind === "chained" ? chainRoot !== void 0 ? `publishes '${loggedExportKey}' by RE-EXPORTING a value that '${chainRoot}' declares from a {{resolve:...}} expression${through}` : `publishes '${loggedExportKey}' by RE-EXPORTING a value another stack of this app declares from a {{resolve:...}} expression` : chainRoot !== void 0 ? `publishes at least one output that RE-EXPORTS a value '${chainRoot}' declares from a {{resolve:...}} expression${through} (this run could not match '${loggedExportKey}' to a declared output, so it cannot say which)` : `publishes at least one output from a {{resolve:...}} expression (this run could not match '${loggedExportKey}' to a declared output, so it cannot say which)`;
+	const shownKey = displayIdent(loggedExportKey);
+	const shownRoot = chainRoot === void 0 ? void 0 : displayStackName(chainRoot);
+	const through = chain.length > 1 ? ` (through ${chain.slice(0, -1).map((s) => displayStackName(s)).join(", ")})` : "";
+	const templateClaim = verdict.kind === "declared" ? `declares ${shownKey} from a {{resolve:...}} expression` : verdict.kind === "chained" ? chainRoot !== void 0 ? `publishes ${shownKey} by RE-EXPORTING a value that ${shownRoot} declares from a {{resolve:...}} expression${through}` : `publishes ${shownKey} by RE-EXPORTING a value another stack of this app declares from a {{resolve:...}} expression` : chainRoot !== void 0 ? `publishes at least one output that RE-EXPORTS a value ${shownRoot} declares from a {{resolve:...}} expression${through} (this run could not match ${shownKey} to a declared output, so it cannot say which)` : `publishes at least one output from a {{resolve:...}} expression (this run could not match ${shownKey} to a declared output, so it cannot say which)`;
 	const scrubOrder = dedupePreservingOrder([...chain].reverse().concat(loggedProducerStack), "last");
 	const remedyCommands = scrubOrder.map((name) => `Scrub with: ${pasteableCommand("cdkd scrub", [{
 		value: name,
@@ -70993,7 +71086,7 @@ function plaintextProducerCrossStackReadError(origin, stackName, intrinsic, path
 	const loggedExportKey = maskSecretsInText(exportKey, secrets);
 	const loggedProducerStack = maskSecretsInText(producerStack, secrets);
 	const { templateClaim, remedy, remedyCommands } = scrubRefusalWording(verdict, loggedExportKey, loggedProducerStack, verdict.via.map((s) => maskSecretsInText(s, secrets)));
-	return new ScrubRefusalError(`Scrub of ${stackName} resolved the ${intrinsic} in ${origin}${path ? ` at ${path}` : ""} to a PLAINTEXT value: the producer stack '${loggedProducerStack}' ${templateClaim}, but its own state still stores the resolved plaintext rather than that expression. scrub has no expression to write in this stack's place, so it cannot redact the imported secret and must not report this stack clean. ${remedy}, then re-run scrub for this stack — the read will then return the expression and this stack is scrubbed normally.\n${remedyCommands.join("\n")}\nThen re-run: ${pasteableCommand("cdkd scrub", [{
+	return new ScrubRefusalError(`Scrub of ${displayStackName(stackName)} resolved the ${intrinsic} in ${origin}${path ? ` at ${maskedIdent(path, secrets)}` : ""} to a PLAINTEXT value: the producer stack ${displayStackName(loggedProducerStack)} ${templateClaim}, but its own state still stores the resolved plaintext rather than that expression. scrub has no expression to write in this stack's place, so it cannot redact the imported secret and must not report this stack clean. ${remedy}, then re-run scrub for this stack — the read will then return the expression and this stack is scrubbed normally.\n${remedyCommands.join("\n")}\nThen re-run: ${pasteableCommand("cdkd scrub", [{
 		value: stackName,
 		hole: "stack",
 		opts: { patternMatched: true }
@@ -71445,6 +71538,16 @@ function isNamelessDynamicReferenceFailure(err) {
 	return isNamelessDynamicReferenceError(err);
 }
 /**
+* An assembly-chosen NAME (a logical id, a property or output name, a property
+* path, a secret reference's name) rendered into scrub's prose: MASKED FIRST,
+* then bounded (go-to-k/cdkd#3638). `displayIdent` JSON-escapes, blanks
+* non-ASCII and cuts at 255, any of which would stop a recorded plaintext
+* embedded in the name from matching a mask that ran over the rendered text.
+*/
+function maskedIdent(value, secrets) {
+	return displayIdent(maskSecretsInText(value, secrets));
+}
+/**
 * The per-record line each counting site prints. Deliberately ONE SHORT
 * SENTENCE, and that is a fix rather than a style choice: the first cut emitted
 * a ~440-character paragraph PER RECORD at default verbosity, and the arm it
@@ -71459,11 +71562,9 @@ function isNamelessDynamicReferenceFailure(err) {
 * it through `maskSecretsInText`, and a resolver error echoes what it was
 * handed — which, after `pinCrossRegionSecrets`, can be a foreign plaintext.
 *
-* RESIDUAL on the `subject` the call sites pass. They compose
-* `maskSecretsInText(... displaySafe(id) ...)` — sanitise, then mask — and
-* `displaySafe` REPLACES a control character with a space rather than deleting
-* it, so it cannot JOIN a split needle (the go-to-k/cdkd#2874 direction) but it
-* can BREAK one, and it leaves `U+200B`-`U+200D` / `U+FEFF` untouched. A secret
+* The `subject` the call sites pass renders each name through
+* {@link maskedIdent} — masked, then bounded — so bounding cannot break a needle.
+* RESIDUAL: the mask sees only what this run has recorded SO FAR, and a secret
 * would have to sit inside a template logical id or Outputs key to be reachable,
 * which is why `secretSafeKeyDisplay` is not used here — that one is for RESOLVED
 * state-bag keys. Recorded rather than closed: go-to-k/cdkd#3178 security review.
@@ -71850,6 +71951,7 @@ var SharedEntriesSecrets = class extends Map {
 */
 function makeCrossStackPrePass(deps) {
 	const { stackName, resolver, producerTemplates, findings, logger } = deps;
+	const shownStackName = displayStackName(stackName);
 	const exportOwners = buildExportOwnerIndex(producerTemplates);
 	const verdicts = /* @__PURE__ */ new Map();
 	/**
@@ -72004,26 +72106,27 @@ function makeCrossStackPrePass(deps) {
 		*/
 		const storedProducerValue = async (producer, backend, nodeCanRefuse) => {
 			if (!backend) return void 0;
+			const shownProducer = displayStackName(maskSecretsInText(producer.stack, secrets));
 			let loaded;
 			try {
 				loaded = await backend.getState(producer.stack, producer.region);
 			} catch (err) {
-				logger.debug(`Scrub of ${stackName}: could not re-read producer '${maskSecretsInText(producer.stack, secrets)}' (${producer.region}) to classify its stored value: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+				logger.debug(`Scrub of ${shownStackName}: could not re-read producer ${shownProducer} (${displayIdent(producer.region)}) to classify its stored value: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
 				return;
 			}
 			const outputs = loaded?.state?.outputs;
 			if (outputs !== void 0 && !isReadableBag(outputs)) {
 				if (!nodeCanRefuse) {
-					logger.debug(`Scrub of ${stackName}: producer '${maskSecretsInText(producer.stack, secrets)}' (${producer.region}) has no readable 'outputs' map, and this position cannot refuse.`);
+					logger.debug(`Scrub of ${shownStackName}: producer ${shownProducer} (${displayIdent(producer.region)}) has no readable 'outputs' map, and this position cannot refuse.`);
 					return;
 				}
 				const seenKey = producerRecordKey(producer.stack, producer.region);
 				if (!warnedDamagedProducers.has(seenKey)) {
 					warnedDamagedProducers.add(seenKey);
-					const detail = `the stored value of producer '${maskSecretsInText(producer.stack, secrets)}' (${producer.region}), whose 'outputs' map cannot be read`;
+					const detail = `the stored value of producer ${shownProducer} (${displayIdent(producer.region)}), whose 'outputs' map cannot be read`;
 					findings.unverifiable.push(detail);
 					findings.damagedProducerRecords.push(detail);
-					logger.warn(`Scrub of ${stackName}: producer '${maskSecretsInText(producer.stack, secrets)}' (${producer.region}) has no readable 'outputs' map, so its stored value could NOT be classified — this run cannot tell whether it still holds plaintext for the value ${stackName} imports from it. ${stackName} is scrubbed for everything else. Repair that record and scrub it first.`);
+					logger.warn(`Scrub of ${shownStackName}: producer ${shownProducer} (${displayIdent(producer.region)}) has no readable 'outputs' map, so its stored value could NOT be classified — this run cannot tell whether it still holds plaintext for the value ${shownStackName} imports from it. ${shownStackName} is scrubbed for everything else. Repair that record and scrub it first.`);
 				}
 				return;
 			}
@@ -72037,60 +72140,60 @@ function makeCrossStackPrePass(deps) {
 				recordedImports: [],
 				recordedOutputReads: []
 			};
-			const where = `${key} in ${origin}${path ? ` at ${path}` : ""}`;
+			const where = `${key} in ${origin}${path ? ` at ${maskedIdent(path, secrets)}` : ""}`;
 			try {
 				await resolver.resolve({ [key]: node[key] }, probe);
 			} catch (err) {
 				if (!nodeCanRefuse) {
-					logger.debug(`Scrub of ${stackName}: ${where} could not be resolved, and this position cannot refuse: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
+					logger.debug(`Scrub of ${shownStackName}: ${where} could not be resolved, and this position cannot refuse: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`);
 					return;
 				}
 				if (isByDesignRefusal(err)) {
 					const detail = `${where}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`;
 					findings.unverifiable.push(detail);
-					logger.warn(`Scrub of ${stackName} cannot verify ${detail} — cdkd declines this read by design, so no re-run can change it. The rest of the stack is still scrubbed; this stack is NOT reported clean.`);
+					logger.warn(`Scrub of ${shownStackName} cannot verify ${detail} — cdkd declines this read by design, so no re-run can change it. The rest of the stack is still scrubbed; this stack is NOT reported clean.`);
 					return;
 				}
 				if (isMalformedProducerRefusal(err)) {
 					const detail = `${where}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), secrets)}`;
 					findings.unverifiable.push(detail);
 					findings.damagedProducerRecords.push(detail);
-					logger.warn(`Scrub of ${stackName} cannot verify ${detail} — the PRODUCER's state record is malformed or truncated, so this run cannot tell whether that producer still holds the plaintext. The rest of the stack is still scrubbed; this stack is NOT reported clean. Repair the producer's record and scrub it first, then re-run.`);
+					logger.warn(`Scrub of ${shownStackName} cannot verify ${detail} — the PRODUCER's state record is malformed or truncated, so this run cannot tell whether that producer still holds the plaintext. The rest of the stack is still scrubbed; this stack is NOT reported clean. Repair the producer's record and scrub it first, then re-run.`);
 					return;
 				}
 				throw unresolvableCrossStackReadError(origin, stackName, key, path, err, secrets);
 			}
 			const producer = recordedProducer(key, probe);
 			if (!producer) {
-				logger.debug(`Scrub of ${stackName}: ${where} resolved, but the resolver recorded no cdkd cross-stack read for it — the value came from a CloudFormation fallback or a cross-account arm that records nothing, so scrub cannot name a producer to classify. Not classified as a plaintext producer.`);
+				logger.debug(`Scrub of ${shownStackName}: ${where} resolved, but the resolver recorded no cdkd cross-stack read for it — the value came from a CloudFormation fallback or a cross-account arm that records nothing, so scrub cannot name a producer to classify. Not classified as a plaintext producer.`);
 				return;
 			}
-			const loggedKey = maskSecretsInText(producer.key, secrets);
-			const loggedStack = maskSecretsInText(producer.stack, secrets);
+			const loggedKey = displayIdent(maskSecretsInText(producer.key, secrets));
+			const loggedStack = displayStackName(maskSecretsInText(producer.stack, secrets));
 			if (!producerTemplates.has(producer.stack)) {
-				logger.debug(`Scrub of ${stackName}: ${where} resolved through producer '${loggedStack}' (${producer.region}), which is not a stack of this app — scrub has no template to classify export '${loggedKey}' with. Not classified as a plaintext producer.`);
+				logger.debug(`Scrub of ${shownStackName}: ${where} resolved through producer ${loggedStack} (${displayIdent(producer.region)}), which is not a stack of this app — scrub has no template to classify export ${loggedKey} with. Not classified as a plaintext producer.`);
 				return;
 			}
 			const verdict = secretExpressionVerdict(producer.stack, producer.key);
 			if (verdict.kind === "no") {
-				logger.debug(`Scrub of ${stackName}: ${where} resolved through producer '${loggedStack}', whose template declares no {{resolve:...}} expression for '${loggedKey}' and no re-export chain reaching one. Not classified as a plaintext producer.`);
+				logger.debug(`Scrub of ${shownStackName}: ${where} resolved through producer ${loggedStack}, whose template declares no {{resolve:...}} expression for ${loggedKey} and no re-export chain reaching one. Not classified as a plaintext producer.`);
 				return;
 			}
 			const stored = await storedProducerValue(producer, context.stateBackend, nodeCanRefuse);
 			if (!stored) {
-				logger.debug(`Scrub of ${stackName}: ${where} resolved through producer '${loggedStack}' (${producer.region}), whose state record could not be read or does not carry the key '${loggedKey}' — cannot classify, so this is not classified as a plaintext producer.`);
+				logger.debug(`Scrub of ${shownStackName}: ${where} resolved through producer ${loggedStack} (${displayIdent(producer.region)}), whose state record could not be read or does not carry the key ${loggedKey} — cannot classify, so this is not classified as a plaintext producer.`);
 				return;
 			}
 			if (carriesDynamicReference(stored.stored)) {
-				logger.debug(`Scrub of ${stackName}: ${where} resolved through producer '${loggedStack}', whose stored value for '${loggedKey}' already carries a {{resolve:...}} expression — the producer is scrubbed and there is nothing wrong with this read.`);
+				logger.debug(`Scrub of ${shownStackName}: ${where} resolved through producer ${loggedStack}, whose stored value for ${loggedKey} already carries a {{resolve:...}} expression — the producer is scrubbed and there is nothing wrong with this read.`);
 				return;
 			}
 			if (storedValueCarriesNoPlaintext(stored.stored)) {
-				logger.debug(`Scrub of ${stackName}: ${where} resolved through producer '${loggedStack}', whose stored value for that key carries no text — nothing to redact, so this is not classified as a plaintext producer.`);
+				logger.debug(`Scrub of ${shownStackName}: ${where} resolved through producer ${loggedStack}, whose stored value for that key carries no text — nothing to redact, so this is not classified as a plaintext producer.`);
 				return;
 			}
 			if (!nodeCanRefuse) {
-				logger.debug(`Scrub of ${stackName}: ${where} resolved to a plaintext from unscrubbed producer '${loggedStack}', and this position cannot refuse.`);
+				logger.debug(`Scrub of ${shownStackName}: ${where} resolved to a plaintext from unscrubbed producer ${loggedStack}, and this position cannot refuse.`);
 				return;
 			}
 			throw plaintextProducerCrossStackReadError(origin, stackName, key, path, producer.stack, producer.key, verdict, secrets);
@@ -72147,6 +72250,7 @@ function makeCrossStackPrePass(deps) {
 */
 async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 	const { logger } = opts;
+	const shownStack = displayStackName(stack.stackName);
 	const acquired = !opts.dryRun;
 	if (acquired) await lockManager.acquireLockWithRetry(stack.stackName, region, void 0, "scrub");
 	const perResourceSecrets = /* @__PURE__ */ new Map();
@@ -72232,7 +72336,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 	try {
 		const loaded = await stateBackend.getState(stack.stackName, region);
 		if (!loaded) {
-			logger.debug(`No state for ${stack.stackName} (${region}) — skipping`);
+			logger.debug(`No state for ${shownStack} (${displayIdent(region)}) — skipping`);
 			return {
 				recordsChanged: 0,
 				secretsFound: 0,
@@ -72285,7 +72389,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		try {
 			parameters = await resolver.resolveParameters(stack.template);
 		} catch (err) {
-			logger.debug(`Parameter resolution skipped for ${stack.stackName}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
+			logger.debug(`Parameter resolution skipped for ${shownStack}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
 		}
 		const resolverStateBackend = memoizeCrossStackStateReads(stateBackend);
 		const resolverContext = (recordedSecretValues) => ({
@@ -72309,7 +72413,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		try {
 			conditions = await resolver.evaluateConditions(resolverContext(outputSecrets));
 		} catch (err) {
-			logger.debug(`Condition evaluation skipped for ${stack.stackName}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
+			logger.debug(`Condition evaluation skipped for ${shownStack}: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
 		}
 		const templateResources = stack.template.Resources ?? {};
 		const templateOutputs = stack.template.Outputs ?? {};
@@ -72329,10 +72433,10 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					producerRegions,
 					resolvers,
 					recordedSecretValues,
-					origin: `resource '${logicalId}'`
+					origin: `resource ${maskedIdent(logicalId, recordedSecretValues)}`
 				});
 				const resourceContext = resolverContext(recordedSecretValues);
-				await resolveCrossStackReads(resolveInput, resourceContext, `resource '${logicalId}'`);
+				await resolveCrossStackReads(resolveInput, resourceContext, `resource ${maskedIdent(logicalId, recordedSecretValues)}`);
 				const bagKeys = resolveInput !== null && typeof resolveInput === "object" && !Array.isArray(resolveInput) ? Object.keys(resolveInput) : void 0;
 				const intrinsicShapedBag = bagKeys?.some((k) => RESOLVER_DISPATCH_KEYS.has(k)) ?? false;
 				const resolveUnits = bagKeys && !intrinsicShapedBag ? Object.entries(resolveInput) : [["", resolveInput]];
@@ -72343,16 +72447,16 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 							...resourceContext,
 							abandonedResolutions: abandoned
 						});
-						reportAbandonedBag(abandoned, propertyName ? `resource '${displaySafe(logicalId)}' property '${displaySafe(propertyName)}'` : `resource '${displaySafe(logicalId)}'`, recordedSecretValues, `${displaySafe(logicalId)}${propertyName ? `.${displaySafe(propertyName)}` : ""}`);
+						reportAbandonedBag(abandoned, propertyName ? `resource ${maskedIdent(logicalId, recordedSecretValues)} property ${maskedIdent(propertyName, recordedSecretValues)}` : `resource ${maskedIdent(logicalId, recordedSecretValues)}`, recordedSecretValues, `${maskedIdent(logicalId, recordedSecretValues)}${propertyName ? `.${maskedIdent(propertyName, recordedSecretValues)}` : ""}`);
 					} catch (err) {
 						if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
 						const leafVerdict = abandonedScanVerdict(propertyValue, err);
 						if (leafVerdict !== "silent") {
 							if (leafVerdict === "count") unverifiableLeaves++;
 							else ungateableAbandonedScans++;
-							logger.warn(maskSecretsInText(abandonedScanWarning(propertyName ? `resource '${displaySafe(logicalId)}' property '${displaySafe(propertyName)}'` : `resource '${displaySafe(logicalId)}'`, leafVerdict), recordedSecretValues));
+							logger.warn(maskSecretsInText(abandonedScanWarning(propertyName ? `resource ${maskedIdent(logicalId, recordedSecretValues)} property ${maskedIdent(propertyName, recordedSecretValues)}` : `resource ${maskedIdent(logicalId, recordedSecretValues)}`, leafVerdict), recordedSecretValues));
 						}
-						logger.debug(maskSecretsInText(`Resolution of ${displaySafe(logicalId)}${propertyName ? `.${displaySafe(propertyName)}` : ""} during scrub was partial: ${err instanceof Error ? err.message : String(err)}`, recordedSecretValues));
+						logger.debug(maskSecretsInText(`Resolution of ${maskedIdent(logicalId, recordedSecretValues)}${propertyName ? `.${maskedIdent(propertyName, recordedSecretValues)}` : ""} during scrub was partial: ${err instanceof Error ? err.message : String(err)}`, recordedSecretValues));
 					}
 				}
 				perResourceTemplateProps.set(logicalId, templateResource.Properties);
@@ -72369,7 +72473,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					producerRegions,
 					resolvers,
 					recordedSecretValues,
-					origin: `orphan record '${record.logicalId}'`
+					origin: `orphan record ${maskedIdent(record.logicalId, recordedSecretValues)}`
 				});
 				const orphanContext = resolverContext(recordedSecretValues);
 				for (const [bagName, bagValue] of Object.entries(resolveInput)) {
@@ -72379,16 +72483,16 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 							...orphanContext,
 							abandonedResolutions: abandoned
 						});
-						reportAbandonedBag(abandoned, `orphan record '${displaySafe(record.logicalId)}' ${bagName}`, recordedSecretValues, `orphan record ${displaySafe(record.logicalId)} ${bagName}`);
+						reportAbandonedBag(abandoned, `orphan record ${maskedIdent(record.logicalId, recordedSecretValues)} ${bagName}`, recordedSecretValues, `orphan record ${maskedIdent(record.logicalId, recordedSecretValues)} ${bagName}`);
 					} catch (err) {
 						if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
 						const leafVerdict = abandonedScanVerdict(bagValue, err);
 						if (leafVerdict !== "silent") {
 							if (leafVerdict === "count") unverifiableLeaves++;
 							else ungateableAbandonedScans++;
-							logger.warn(maskSecretsInText(abandonedScanWarning(`orphan record '${displaySafe(record.logicalId)}' ${bagName}`, leafVerdict), recordedSecretValues));
+							logger.warn(maskSecretsInText(abandonedScanWarning(`orphan record ${maskedIdent(record.logicalId, recordedSecretValues)} ${bagName}`, leafVerdict), recordedSecretValues));
 						}
-						logger.debug(maskSecretsInText(`Resolution of orphan record ${displaySafe(record.logicalId)} ${bagName} during scrub was partial: ${err instanceof Error ? err.message : String(err)}`, recordedSecretValues));
+						logger.debug(maskSecretsInText(`Resolution of orphan record ${maskedIdent(record.logicalId, recordedSecretValues)} ${bagName} during scrub was partial: ${err instanceof Error ? err.message : String(err)}`, recordedSecretValues));
 					}
 				}
 			}
@@ -72404,10 +72508,10 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 						producerRegions,
 						resolvers,
 						recordedSecretValues: nameSecrets,
-						origin: `Export.Name of output '${name}'`
+						origin: `Export.Name of output ${maskedIdent(name, nameSecrets)}`
 					});
 					const nameContext = resolverContext(nameSecrets);
-					await resolveCrossStackReads(nameSource, nameContext, `Export.Name of output '${name}'`, { canRefuse: !isOutputSuppressed(name, output, conditions, state.outputs ?? {}) });
+					await resolveCrossStackReads(nameSource, nameContext, `Export.Name of output ${maskedIdent(name, nameSecrets)}`, { canRefuse: !isOutputSuppressed(name, output, conditions, state.outputs ?? {}) });
 					try {
 						exportName = await resolver.resolve(nameSource, nameContext);
 					} catch (err) {
@@ -72416,14 +72520,14 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 						if (leafVerdict !== "silent") {
 							if (leafVerdict === "count") unverifiableLeaves++;
 							else ungateableAbandonedScans++;
-							logger.warn(maskSecretsInText(abandonedScanWarning(`the Export.Name of output '${displaySafe(name)}'`, leafVerdict), outputSecrets));
+							logger.warn(maskSecretsInText(abandonedScanWarning(`the Export.Name of output ${maskedIdent(name, outputSecrets)}`, leafVerdict), outputSecrets));
 						}
 						nameFailed = true;
 						nameError = err;
 					}
 					if (nameFailed) {
 						outputsSourceUntrusted = true;
-						logger.warn(`Export.Name of output ${name} could not be resolved during scrub (${maskSecretsInText(nameError instanceof Error ? nameError.message : String(nameError), outputSecrets)}) — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
+						logger.warn(`Export.Name of output ${maskedIdent(name, outputSecrets)} could not be resolved during scrub (${maskSecretsInText(nameError instanceof Error ? nameError.message : String(nameError), outputSecrets)}) — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
 					}
 				}
 				if (declaredExportName !== void 0 && typeof exportName !== "string") outputsSourceUntrusted = true;
@@ -72431,7 +72535,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				if (typeof exportName === "string" && !exportNameUnresolved) accountedOutputKeys.add(exportName);
 				if (exportNameUnresolved) {
 					outputsSourceUntrusted = true;
-					logger.warn(`Export.Name of output ${name} did not fully resolve during scrub — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
+					logger.warn(`Export.Name of output ${maskedIdent(name, outputSecrets)} did not fully resolve during scrub — redacting this stack's outputs by value match instead of by template position, since state may be keyed under a name this run cannot reproduce.`);
 				} else if (typeof exportName === "string" && isExportAliasCollision(exportName, name, declaredOutputNames)) {
 					ambiguousKeys.add(exportName);
 					collisions.push([name, exportName]);
@@ -72448,26 +72552,26 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					producerRegions,
 					resolvers,
 					recordedSecretValues: outputSecrets,
-					origin: `output '${name}'`
+					origin: `output ${maskedIdent(name, outputSecrets)}`
 				});
 				const valueContext = resolverContext(outputSecrets);
-				await resolveCrossStackReads(valueSource, valueContext, `output '${name}'`, { canRefuse: !isOutputSuppressed(name, output, conditions, state.outputs ?? {}) });
+				await resolveCrossStackReads(valueSource, valueContext, `output ${maskedIdent(name, outputSecrets)}`, { canRefuse: !isOutputSuppressed(name, output, conditions, state.outputs ?? {}) });
 				const abandonedOutput = [];
 				try {
 					await resolver.resolve(valueSource, {
 						...valueContext,
 						abandonedResolutions: abandonedOutput
 					});
-					reportAbandonedBag(abandonedOutput, `output '${displaySafe(name)}'`, outputSecrets, `output ${displaySafe(name)}`);
+					reportAbandonedBag(abandonedOutput, `output ${maskedIdent(name, outputSecrets)}`, outputSecrets, `output ${maskedIdent(name, outputSecrets)}`);
 				} catch (err) {
 					if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
 					const leafVerdict = abandonedScanVerdict(valueSource, err);
 					if (leafVerdict !== "silent") {
 						if (leafVerdict === "count") unverifiableLeaves++;
 						else ungateableAbandonedScans++;
-						logger.warn(maskSecretsInText(abandonedScanWarning(`output '${displaySafe(name)}'`, leafVerdict), outputSecrets));
+						logger.warn(maskSecretsInText(abandonedScanWarning(`output ${maskedIdent(name, outputSecrets)}`, leafVerdict), outputSecrets));
 					}
-					logger.debug(`Resolution of output ${name} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
+					logger.debug(`Resolution of output ${maskedIdent(name, outputSecrets)} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
 				}
 			}
 		});
@@ -72580,7 +72684,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 		throw maskSecretsInError(err, allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets));
 	} finally {
 		if (acquired) await lockManager.releaseLock(stack.stackName, region).catch((err) => {
-			logger.warn(`Failed to release lock for ${stack.stackName}: ${err instanceof Error ? err.message : String(err)}`);
+			logger.warn(`Failed to release lock for ${shownStack}: ${err instanceof Error ? err.message : String(err)}`);
 		});
 	}
 }
@@ -86366,7 +86470,7 @@ var AttributeFetcher = class {
 		const orphan = this.orphans[orphanLogicalId];
 		const bag = orphan.attributes;
 		if (bag !== void 0 && !isReadableBag(bag)) {
-			this.logger.warn(`--force: state.attributes of '${displaySafe(orphanLogicalId, { asciiOnly: true })}' is not a readable map, so it is not consulted for '${displaySafe(attribute, { asciiOnly: true })}'; leaving the original intrinsic in place.`);
+			this.logger.warn(`--force: state.attributes of ${displayIdent(orphanLogicalId)} is not a readable map, so it is not consulted for ${displayIdent(attribute)}; leaving the original intrinsic in place.`);
 			return {
 				ok: false,
 				reason: `${reason}; the state.attributes cache is not a readable map`
@@ -88372,7 +88476,7 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 	if (divergentParameters !== void 0 && divergentParameters.size > 0) try {
 		parameterTaint = computeParameterTaint(template, new Map(entries.map(([logicalId, resource]) => [logicalId, resource.properties])), divergentParameters);
 	} catch (err) {
-		logger.debug(`observed-baseline parameter-dependence walk failed for '${displaySafe(stackState.stackName)}': ${err instanceof Error ? err.name : typeof err} — refusing every baseline in the stack fail-closed.`);
+		logger.debug(`observed-baseline parameter-dependence walk failed for ${displayStackName(stackState.stackName)}: ${err instanceof Error ? err.name : typeof err} — refusing every baseline in the stack fail-closed.`);
 		const all = new Set(entries.map(([logicalId]) => logicalId));
 		parameterTaint = {
 			refused: all,
@@ -88425,8 +88529,8 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 		const refusedHere = [...parameterTaint.refused].filter((id) => inState.has(id));
 		const unreadable = refusedHere.filter((id) => parameterTaint.unclassifiable.has(id));
 		if (refusedHere.length > 0) {
-			const named = [...parameterTaint.parametersHit].sort().map((name) => displaySafe(name));
-			logger.warn(`${refusedHere.length} resource(s) in '${displaySafe(stackState.stackName)}' depend, directly or through another resource's attributes, on template parameter(s) whose deployed CloudFormation value could not be proven equal to the template 'Default' 'cdkd import' binds` + (named.length > 0 ? ` (${named.join(", ")})` : "") + (unreadable.length > 0 ? ` — ${unreadable.length} of them because their properties could not be checked for such a dependence` : "") + ". Their recorded properties hold the 'Default', NOT the deployed value, and no observed drift baseline was captured for them by this import (the live value may be a secret this import cannot position a redaction for). Review 'cdkd diff' before the next 'cdkd deploy'.");
+			const named = [...parameterTaint.parametersHit].sort().map((name) => displayIdent(name));
+			logger.warn(`${refusedHere.length} resource(s) in ${displayStackName(stackState.stackName)} depend, directly or through another resource's attributes, on template parameter(s) whose deployed CloudFormation value could not be proven equal to the template 'Default' 'cdkd import' binds` + (named.length > 0 ? ` (${named.join(", ")})` : "") + (unreadable.length > 0 ? ` — ${unreadable.length} of them because their properties could not be checked for such a dependence` : "") + ". Their recorded properties hold the 'Default', NOT the deployed value, and no observed drift baseline was captured for them by this import (the live value may be a secret this import cannot position a redaction for). Review 'cdkd diff' before the next 'cdkd deploy'.");
 		}
 	}
 	return unsafeObservedBaselineLogicalIds;
@@ -89048,9 +89152,9 @@ function indexGrandchildTemplatePaths(childTemplate, childTemplatePath) {
 		if (resource.Type !== "AWS::CloudFormation::Stack") continue;
 		const assetPath = resource.Metadata?.["aws:asset:path"];
 		if (typeof assetPath !== "string" || assetPath.length === 0) continue;
-		if (path.isAbsolute(assetPath)) throw new Error(`cdkd import --migrate-from-cloudformation: grandchild nested-stack '${displaySafe(grandLogicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which is absolute. CDK emits relative asset paths for nested templates.`);
+		if (path.isAbsolute(assetPath)) throw new Error(`cdkd import --migrate-from-cloudformation: grandchild nested-stack ${displayIdent(grandLogicalId)} has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which is absolute. CDK emits relative asset paths for nested templates.`);
 		const resolved = resolveAssemblyPath(dir, assetPath);
-		if (!resolved.contained) throw new Error(`cdkd import --migrate-from-cloudformation: grandchild nested-stack '${displaySafe(grandLogicalId)}' has Metadata['aws:asset:path']='${displaySafe(assetPath)}' which ${renderAssemblyPathEscape(resolved, dir)}`);
+		if (!resolved.contained) throw new Error(`cdkd import --migrate-from-cloudformation: grandchild nested-stack ${displayIdent(grandLogicalId)} has Metadata['aws:asset:path']=${displayAssemblyPath(assetPath)} which ${renderAssemblyPathEscape(resolved, dir)}`);
 		result[grandLogicalId] = resolved.path;
 	}
 	return result;
@@ -95028,7 +95132,7 @@ async function resolveOne(entry, secretsClient, ssmClient) {
 	switch (shape.kind) {
 		case "secrets-manager": return resolveSecretsManager(entry, shape, secretsClient);
 		case "ssm": return resolveSsm(entry, shape, ssmClient);
-		case "unknown": throw new EcsSecretsResolutionError(`Container '${displayIdent(entry.containerName)}' secret '${displayIdent(entry.name)}' references an unsupported ValueFrom shape ${displayIdent(arn, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}. Expected Secrets Manager ARN (optionally with :<json-key>::) or SSM Parameter ARN.`);
+		case "unknown": throw new EcsSecretsResolutionError(`Container ${displayIdent(entry.containerName)} secret ${displayIdent(entry.name)} references an unsupported ValueFrom shape ${displayIdent(arn, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}. Expected Secrets Manager ARN (optionally with :<json-key>::) or SSM Parameter ARN.`);
 	}
 }
 /**
@@ -95061,20 +95165,20 @@ async function resolveSecretsManager(entry, shape, client) {
 	try {
 		secretString = (await client.send(new GetSecretValueCommand({ SecretId: shape.baseArn }))).SecretString;
 	} catch (err) {
-		throw new EcsSecretsResolutionError(`Failed to resolve Secrets Manager secret for container '${displayIdent(entry.containerName)}' / env '${displayIdent(entry.name)}' (${displayIdent(shape.baseArn, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}): ${displaySafe(err instanceof Error ? err.message : String(err))}`);
+		throw new EcsSecretsResolutionError(`Failed to resolve Secrets Manager secret for container ${displayIdent(entry.containerName)} / env ${displayIdent(entry.name)} (${displayIdent(shape.baseArn, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}): ${displaySafe(err instanceof Error ? err.message : String(err))}`);
 	}
-	if (secretString === void 0) throw new EcsSecretsResolutionError(`Secrets Manager returned no SecretString for container '${displayIdent(entry.containerName)}' / env '${displayIdent(entry.name)}' (${displayIdent(shape.baseArn, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}). Binary secrets are not supported.`);
+	if (secretString === void 0) throw new EcsSecretsResolutionError(`Secrets Manager returned no SecretString for container ${displayIdent(entry.containerName)} / env ${displayIdent(entry.name)} (${displayIdent(shape.baseArn, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}). Binary secrets are not supported.`);
 	if (shape.jsonKey === void 0) return secretString;
 	let parsed;
 	try {
 		parsed = JSON.parse(secretString);
 	} catch (err) {
 		const kind = err instanceof Error ? err.name : "unknown";
-		throw new EcsSecretsResolutionError(`Container '${displayIdent(entry.containerName)}' secret '${displayIdent(entry.name)}' specified json-key '${displaySafe(shape.jsonKey)}' but the secret value is not valid JSON (${displayIdent(kind)}). The parser detail is withheld because it would echo the secret plaintext.`);
+		throw new EcsSecretsResolutionError(`Container ${displayIdent(entry.containerName)} secret ${displayIdent(entry.name)} specified json-key ${displayIdent(shape.jsonKey)} but the secret value is not valid JSON (${displayIdent(kind)}). The parser detail is withheld because it would echo the secret plaintext.`);
 	}
-	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new EcsSecretsResolutionError(`Container '${displayIdent(entry.containerName)}' secret '${displayIdent(entry.name)}' specified json-key '${displaySafe(shape.jsonKey)}' but the secret root is not a JSON object.`);
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new EcsSecretsResolutionError(`Container ${displayIdent(entry.containerName)} secret ${displayIdent(entry.name)} specified json-key ${displayIdent(shape.jsonKey)} but the secret root is not a JSON object.`);
 	const value = parsed[shape.jsonKey];
-	if (value === void 0) throw new EcsSecretsResolutionError(`Container '${displayIdent(entry.containerName)}' secret '${displayIdent(entry.name)}' specified json-key '${displaySafe(shape.jsonKey)}' but no such key exists in the secret JSON.`);
+	if (value === void 0) throw new EcsSecretsResolutionError(`Container ${displayIdent(entry.containerName)} secret ${displayIdent(entry.name)} specified json-key ${displayIdent(shape.jsonKey)} but no such key exists in the secret JSON.`);
 	return typeof value === "string" ? value : JSON.stringify(value);
 }
 async function resolveSsm(entry, shape, client) {
@@ -95083,11 +95187,11 @@ async function resolveSsm(entry, shape, client) {
 			Name: shape.name,
 			WithDecryption: true
 		}))).Parameter?.Value;
-		if (value === void 0) throw new EcsSecretsResolutionError(`SSM parameter '${displayIdent(shape.name, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}' returned no Value for container '${displayIdent(entry.containerName)}' / env '${displayIdent(entry.name)}'.`);
+		if (value === void 0) throw new EcsSecretsResolutionError(`SSM parameter ${displayIdent(shape.name, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })} returned no Value for container ${displayIdent(entry.containerName)} / env ${displayIdent(entry.name)}.`);
 		return value;
 	} catch (err) {
 		if (err instanceof EcsSecretsResolutionError) throw err;
-		throw new EcsSecretsResolutionError(`Failed to resolve SSM parameter for container '${displayIdent(entry.containerName)}' / env '${displayIdent(entry.name)}' (${displayIdent(shape.name, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}): ${displaySafe(err instanceof Error ? err.message : String(err))}`);
+		throw new EcsSecretsResolutionError(`Failed to resolve SSM parameter for container ${displayIdent(entry.containerName)} / env ${displayIdent(entry.name)} (${displayIdent(shape.name, { maxCodePoints: SECRET_REF_MAX_CODE_POINTS })}): ${displaySafe(err instanceof Error ? err.message : String(err))}`);
 	}
 }
 
@@ -95500,7 +95604,7 @@ async function prepareOneImage(task, container, options) {
 				tag,
 				...task.stack.assetOutdir !== void 0 && { assetOutdir: task.stack.assetOutdir },
 				...options.platformOverride !== void 0 && { platform: options.platformOverride },
-				wrapError: (stderr) => new LocalInvokeBuildError$1(`docker build failed for ECS container '${displaySafe(container.name)}' (${asset.source.directory !== void 0 ? displayAssemblyPath(asset.source.directory) : asset.source.executable ? redactDockerArgvValues(asset.source.executable).join(" ") : void 0}): ${displaySafe(stderr)}`)
+				wrapError: (stderr) => new LocalInvokeBuildError$1(`docker build failed for ECS container ${displayIdent(container.name)} (${asset.source.directory !== void 0 ? displayAssemblyPath(asset.source.directory) : asset.source.executable ? redactDockerArgvValues(asset.source.executable).join(" ") : void 0}): ${displaySafe(stderr)}`)
 			});
 			if (actualTag !== tag) {
 				const tagArgs = [
@@ -95511,7 +95615,7 @@ async function prepareOneImage(task, container, options) {
 				try {
 					await runDockerStreaming(tagArgs);
 				} catch (err) {
-					throw new LocalInvokeBuildError$1(`docker tag failed re-tagging '${displaySafe(actualTag)}' → '${displaySafe(tag)}' for ECS container '${displaySafe(container.name)}': ${displaySafe(describeDockerFailure(err, tagArgs))}`);
+					throw new LocalInvokeBuildError$1(`docker tag failed re-tagging ${displayIdent(actualTag)} → ${displayIdent(tag)} for ECS container ${displayIdent(container.name)}: ${displaySafe(describeDockerFailure(err, tagArgs))}`);
 				}
 			}
 			return tag;
@@ -99040,4 +99144,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-CQ_Y14q1.js.map
+//# sourceMappingURL=program-BALgPCWL.js.map